drivers/bluetooth/rtk_btusb.c

   1 /*
   2  *
   3  *  Realtek Bluetooth USB driver
   4  *
   5  *
   6  *  This program is free software; you can redistribute it and/or modify
   7  *  it under the terms of the GNU General Public License as published by
   8  *  the Free Software Foundation; either version 2 of the License, or
   9  *  (at your option) any later version.
  10  *
  11  *  This program is distributed in the hope that it will be useful,
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *  GNU General Public License for more details.
  15  *
  16  *  You should have received a copy of the GNU General Public License
  17  *  along with this program; if not, write to the Free Software
  18  *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  19  *
  20  */
  21
  22 #include <linux/kernel.h>
  23 #include <linux/module.h>
  24 #include <linux/init.h>
  25 #include <linux/slab.h>
  26 #include <linux/types.h>
  27 #include <linux/sched.h>
  28 #include <linux/errno.h>
  29 #include <linux/skbuff.h>
  30 #include <linux/usb.h>
  31
  32 /*******************************/
  33 #include "rtk_btusb.h"
  34 #define VERSION "2.21"
  35
  36 #define DBG_FLAG 0
  37 #if DBG_FLAG
  38 #define RTKBT_DBG(fmt, arg...) printk(KERN_INFO "rtk_btusb: " fmt "\n" , ## arg)
  39 #else
  40 #define RTKBT_DBG(fmt, arg...)
  41 #endif
  42 #define RTKBT_INFO(fmt, arg...) printk(KERN_INFO "rtk_btusb: " fmt "\n" , ## arg)
  43 #define RTKBT_WARN(fmt, arg...) printk(KERN_WARNING "rtk_btusb: " fmt "\n" , ## arg)
  44 #define RTKBT_ERR(fmt, arg...) printk(KERN_ERR "rtk_btusb: " fmt "\n" , ## arg)
  45
  46 /*******************************
  47 **    Reasil patch code
  48 ********************************/
  49 #define CMD_CMP_EVT             0x0e
  50 #define PKT_LEN                 300
  51 #define MSG_TO                  1000
  52 #define PATCH_SEG_MAX   252
  53 #define DATA_END                0x80
  54 #define DOWNLOAD_OPCODE 0xfc20
  55 #define BTOFF_OPCODE    0xfc28
  56 #define TRUE                    1
  57 #define FALSE                   0
  58 #define CMD_HDR_LEN             sizeof(struct hci_command_hdr)
  59 #define EVT_HDR_LEN             sizeof(struct hci_event_hdr)
  60 #define CMD_CMP_LEN             sizeof(struct hci_ev_cmd_complete)
  61
  62 enum rtk_endpoit {
  63         CTRL_EP = 0,
  64         INTR_EP = 1,
  65         BULK_EP = 2,
  66         ISOC_EP = 3
  67 };
  68
  69 typedef struct {
  70         uint16_t        prod_id;
  71         uint16_t        lmp_sub_default;
  72         uint16_t        lmp_sub;
  73         uint16_t        eversion;
  74         char            *mp_patch_name;
  75         char            *patch_name;
  76         char            *config_name;
  77         uint8_t         *fw_cache;
  78         int                     fw_len;
  79 } patch_info;
  80
  81 typedef struct {
  82         struct usb_interface    *intf;
  83         struct usb_device               *udev;
  84         patch_info *patch_entry;
  85         int                     pipe_in, pipe_out;
  86         uint8_t         *send_pkt;
  87         uint8_t         *rcv_pkt;
  88         struct hci_command_hdr          *cmd_hdr;
  89         struct hci_event_hdr            *evt_hdr;
  90         struct hci_ev_cmd_complete      *cmd_cmp;
  91         uint8_t         *req_para,      *rsp_para;
  92         uint8_t         *fw_data;
  93         int                     pkt_len;
  94         int                     fw_len;
  95 } firmware_info;
  96
  97 typedef struct {
  98         uint8_t index;
  99         uint8_t data[PATCH_SEG_MAX];
 100 } __attribute__((packed)) download_cp;
 101
 102 typedef struct {
 103         uint8_t status;
 104         uint8_t index;
 105 } __attribute__((packed)) download_rp;
 106
 107 static patch_info fw_patch_table[] = {
 108 /* { pid, lmp_sub_default, lmp_sub, everion, mp_fw_name, fw_name, config_name, fw_cache, fw_len } */
 109 { 0x1724, 0x1200, 0, 0, "mp_rtl8723a_fw", "rtl8723a_fw", "rtl8723a_config", NULL, 0 }, /* RTL8723A */
 110 { 0x8723, 0x1200, 0, 0, "mp_rtl8723a_fw", "rtl8723a_fw", "rtl8723a_config", NULL, 0 }, /* 8723AE */
 111 { 0xA723, 0x1200, 0, 0, "mp_rtl8723a_fw", "rtl8723a_fw", "rtl8723a_config", NULL, 0 }, /* 8723AE for LI */
 112 { 0x0723, 0x1200, 0, 0, "mp_rtl8723a_fw", "rtl8723a_fw", "rtl8723a_config", NULL, 0 }, /* 8723AE */
 113 { 0x3394, 0x1200, 0, 0, "mp_rtl8723a_fw", "rtl8723a_fw", "rtl8723a_config", NULL, 0 }, /* 8723AE for Azurewave*/
 114
 115 { 0x0724, 0x1200, 0, 0, "mp_rtl8723a_fw", "rtl8723a_fw", "rtl8723a_config", NULL, 0 }, /* 8723AU */
 116 { 0x8725, 0x1200, 0, 0, "mp_rtl8723a_fw", "rtl8723a_fw", "rtl8723a_config", NULL, 0 }, /* 8723AU */
 117 { 0x872A, 0x1200, 0, 0, "mp_rtl8723a_fw", "rtl8723a_fw", "rtl8723a_config", NULL, 0 }, /* 8723AU */
 118 { 0x872B, 0x1200, 0, 0, "mp_rtl8723a_fw", "rtl8723a_fw", "rtl8723a_config", NULL, 0 }, /* 8723AU */
 119
 120 { 0xb720, 0x8723, 0, 0, "mp_rtl8723b_fw", "rtl8723b_fw", "rtl8723bu_config", NULL, 0 }, /* RTL8723BU */
 121 { 0xb72A, 0x8723, 0, 0, "mp_rtl8723b_fw", "rtl8723b_fw", "rtl8723bu_config", NULL, 0 }, /* RTL8723BU */
 122 { 0xb728, 0x8723, 0, 0, "mp_rtl8723b_fw", "rtl8723b_fw", "rtl8723b_config", NULL, 0 }, /* RTL8723BE for LC */
 123 { 0xb723, 0x8723, 0, 0, "mp_rtl8723b_fw", "rtl8723b_fw", "rtl8723b_config", NULL, 0 }, /* RTL8723BE */
 124 { 0xb72B, 0x8723, 0, 0, "mp_rtl8723b_fw", "rtl8723b_fw", "rtl8723b_config", NULL, 0 }, /* RTL8723BE */
 125 { 0xb001, 0x8723, 0, 0, "mp_rtl8723b_fw", "rtl8723b_fw", "rtl8723b_config", NULL, 0 }, /* RTL8723BE for HP */
 126 { 0xb002, 0x8723, 0, 0, "mp_rtl8723b_fw", "rtl8723b_fw", "rtl8723b_config", NULL, 0 }, /* RTL8723BE */
 127 { 0xb003, 0x8723, 0, 0, "mp_rtl8723b_fw", "rtl8723b_fw", "rtl8723b_config", NULL, 0 }, /* RTL8723BE */
 128 { 0xb004, 0x8723, 0, 0, "mp_rtl8723b_fw", "rtl8723b_fw", "rtl8723b_config", NULL, 0 }, /* RTL8723BE */
 129 { 0xb005, 0x8723, 0, 0, "mp_rtl8723b_fw", "rtl8723b_fw", "rtl8723b_config", NULL, 0 }, /* RTL8723BE */
 130
 131 { 0x3410, 0x8723, 0, 0, "mp_rtl8723b_fw", "rtl8723b_fw", "rtl8723b_config", NULL, 0 }, /* RTL8723BE for Azurewave */
 132 { 0x3416, 0x8723, 0, 0, "mp_rtl8723b_fw", "rtl8723b_fw", "rtl8723b_config", NULL, 0 }, /* RTL8723BE for Azurewave */
 133 { 0x3459, 0x8723, 0, 0, "mp_rtl8723b_fw", "rtl8723b_fw", "rtl8723b_config", NULL, 0 }, /* RTL8723BE for Azurewave */
 134 { 0xE085, 0x8723, 0, 0, "mp_rtl8723b_fw", "rtl8723b_fw", "rtl8723b_config", NULL, 0 }, /* RTL8723BE for Foxconn */
 135 { 0xE08B, 0x8723, 0, 0, "mp_rtl8723b_fw", "rtl8723b_fw", "rtl8723b_config", NULL, 0 }, /* RTL8723BE for Foxconn */
 136
 137 { 0xA761, 0x8761, 0, 0, "mp_rtl8761a_fw", "rtl8761au_fw", "rtl8761a_config", NULL, 0 }, /* RTL8761AU only */
 138 { 0x818B, 0x8761, 0, 0, "mp_rtl8761a_fw", "rtl8761aw8192eu_fw", "rtl8761aw8192eu_config", NULL, 0 }, /* RTL8761AW + 8192EU */
 139 { 0x818C, 0x8761, 0, 0, "mp_rtl8761a_fw", "rtl8761aw8192eu_fw", "rtl8761aw8192eu_config", NULL, 0 }, /* RTL8761AW + 8192EU */
 140 { 0x8760, 0x8761, 0, 0, "mp_rtl8761a_fw", "rtl8761au8192ee_fw", "rtl8761a_config", NULL, 0 }, /* RTL8761AU + 8192EE */
 141 { 0xB761, 0x8761, 0, 0, "mp_rtl8761a_fw", "rtl8761au8192ee_fw", "rtl8761a_config", NULL, 0 }, /* RTL8761AU + 8192EE */
 142 { 0x8761, 0x8761, 0, 0, "mp_rtl8761a_fw", "rtl8761au8192ee_fw", "rtl8761a_config", NULL, 0 }, /* RTL8761AU + 8192EE for LI */
 143 { 0x8A60, 0x8761, 0, 0, "mp_rtl8761a_fw", "rtl8761au8812ae_fw", "rtl8761a_config", NULL, 0 }, /* RTL8761AU + 8812AE */
 144
 145 { 0x8821, 0x8821, 0, 0, "mp_rtl8821a_fw", "rtl8821a_fw", "rtl8821a_config", NULL, 0 }, /* RTL8821AE */
 146 { 0x0821, 0x8821, 0, 0, "mp_rtl8821a_fw", "rtl8821a_fw", "rtl8821a_config", NULL, 0 }, /* RTL8821AE */
 147 { 0x0823, 0x8821, 0, 0, "mp_rtl8821a_fw", "rtl8821a_fw", "rtl8821a_config", NULL, 0 }, /* RTL8821AU */
 148 { 0x3414, 0x8821, 0, 0, "mp_rtl8821a_fw", "rtl8821a_fw", "rtl8821a_config", NULL, 0 }, /* RTL8821AE */
 149 { 0x3458, 0x8821, 0, 0, "mp_rtl8821a_fw", "rtl8821a_fw", "rtl8821a_config", NULL, 0 }, /* RTL8821AE */
 150 { 0x3461, 0x8821, 0, 0, "mp_rtl8821a_fw", "rtl8821a_fw", "rtl8821a_config", NULL, 0 }, /* RTL8821AE */
 151 { 0x3462, 0x8821, 0, 0, "mp_rtl8821a_fw", "rtl8821a_fw", "rtl8821a_config", NULL, 0 }, /* RTL8821AE */
 152
 153 /* NOTE: must append patch entries above the null entry */
 154 { 0, 0, 0, 0, NULL, NULL, NULL, NULL, 0 }
 155 };
 156
 157 struct btusb_data {
 158         struct hci_dev       *hdev;
 159         struct usb_device    *udev;
 160         struct usb_interface *intf;
 161         struct usb_interface *isoc;
 162
 163         spinlock_t lock;
 164
 165         unsigned long flags;
 166
 167         struct work_struct work;
 168         struct work_struct waker;
 169
 170         struct usb_anchor tx_anchor;
 171         struct usb_anchor intr_anchor;
 172         struct usb_anchor bulk_anchor;
 173         struct usb_anchor isoc_anchor;
 174         struct usb_anchor deferred;
 175         int tx_in_flight;
 176         spinlock_t txlock;
 177
 178         struct usb_endpoint_descriptor *intr_ep;
 179         struct usb_endpoint_descriptor *bulk_tx_ep;
 180         struct usb_endpoint_descriptor *bulk_rx_ep;
 181         struct usb_endpoint_descriptor *isoc_tx_ep;
 182         struct usb_endpoint_descriptor *isoc_rx_ep;
 183
 184         __u8 cmdreq_type;
 185
 186         unsigned int sco_num;
 187         int isoc_altsetting;
 188         int suspend_count;
 189 //#ifdef CONFIG_HAS_EARLYSUSPEND
 190 #if 0
 191         struct early_suspend early_suspend;
 192 #else
 193         struct notifier_block pm_notifier;
 194 #endif
 195         firmware_info *fw_info;
 196 };
 197 #if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 7, 1)
 198 static bool reset_on_close = 0;
 199 #endif
 200
 201 static void rtk_free( struct btusb_data *data)
 202 {
 203 #if LINUX_VERSION_CODE < KERNEL_VERSION(3, 7, 1)
 204         kfree(data);
 205 #endif
 206         return;
 207 }
 208
 209 static struct btusb_data *rtk_alloc(struct usb_interface *intf)
 210 {
 211         struct btusb_data *data;
 212 #if LINUX_VERSION_CODE < KERNEL_VERSION(3, 7, 1)
 213         data = kzalloc(sizeof(*data), GFP_KERNEL);
 214 #else
 215         data = devm_kzalloc(&intf->dev, sizeof(*data), GFP_KERNEL);
 216 #endif
 217         return data;
 218 }
 219
 220 static void print_acl(struct sk_buff *skb, int direction)
 221 {
 222 #if PRINT_ACL_DATA
 223         uint wlength = skb->len;
 224         u16 *handle = (u16 *)(skb->data);
 225         u16 len = *(handle+1);
 226         u8 *acl_data = (u8 *)(skb->data);
 227
 228         RTK_INFO("%s: direction %d, handle %04x, len %d",
 229                         __func__, direction, *handle, len);
 230 #endif
 231 }
 232
 233 static void print_sco(struct sk_buff *skb, int direction)
 234 {
 235 #if PRINT_SCO_DATA
 236         uint wlength = skb->len;
 237         u16 *handle = (u16 *)(skb->data);
 238         u8 len = *(u8 *)(handle+1);
 239         u8 *sco_data =(u8 *)(skb->data);
 240
 241         RTKBT_INFO("%s: direction %d, handle %04x, len %d",
 242                         __func__, direction, *handle, len);
 243 #endif
 244 }
 245
 246 static void print_error_command(struct sk_buff *skb)
 247 {
 248         uint wlength = skb->len;
 249         uint icount = 0;
 250         u16 *opcode = (u16*)(skb->data);
 251         u8 *cmd_data = (u8*)(skb->data);
 252         u8 len = *(cmd_data+2);
 253
 254         switch (*opcode) {
 255         case HCI_OP_INQUIRY:
 256                 printk("HCI_OP_INQUIRY");
 257                 break;
 258         case HCI_OP_INQUIRY_CANCEL:
 259                 printk("HCI_OP_INQUIRY_CANCEL");
 260                 break;
 261         case HCI_OP_EXIT_PERIODIC_INQ:
 262                 printk("HCI_OP_EXIT_PERIODIC_INQ");
 263                 break;
 264         case HCI_OP_CREATE_CONN:
 265                 printk("HCI_OP_CREATE_CONN");
 266                 break;
 267         case HCI_OP_DISCONNECT:
 268                 printk("HCI_OP_DISCONNECT");
 269                 break;
 270         case HCI_OP_CREATE_CONN_CANCEL:
 271                 printk("HCI_OP_CREATE_CONN_CANCEL");
 272                 break;
 273         case HCI_OP_ACCEPT_CONN_REQ:
 274                 printk("HCI_OP_ACCEPT_CONN_REQ");
 275                 break;
 276         case HCI_OP_REJECT_CONN_REQ:
 277                 printk("HCI_OP_REJECT_CONN_REQ");
 278                 break;
 279         case HCI_OP_AUTH_REQUESTED:
 280                 printk("HCI_OP_AUTH_REQUESTED");
 281                 break;
 282         case HCI_OP_SET_CONN_ENCRYPT:
 283                 printk("HCI_OP_SET_CONN_ENCRYPT");
 284                 break;
 285         case HCI_OP_REMOTE_NAME_REQ:
 286                 printk("HCI_OP_REMOTE_NAME_REQ");
 287                 break;
 288         case HCI_OP_READ_REMOTE_FEATURES:
 289                 printk("HCI_OP_READ_REMOTE_FEATURES");
 290                 break;
 291         case HCI_OP_SNIFF_MODE:
 292                 printk("HCI_OP_SNIFF_MODE");
 293                 break;
 294         case HCI_OP_EXIT_SNIFF_MODE:
 295                 printk("HCI_OP_EXIT_SNIFF_MODE");
 296                 break;
 297         case HCI_OP_SWITCH_ROLE:
 298                 printk("HCI_OP_SWITCH_ROLE");
 299                 break;
 300         case HCI_OP_SNIFF_SUBRATE:
 301                 printk("HCI_OP_SNIFF_SUBRATE");
 302                 break;
 303         case HCI_OP_RESET:
 304                 printk("HCI_OP_RESET");
 305                 break;
 306         default:
 307                 printk("CMD");
 308                 break;
 309         }
 310         printk(":%04x,len:%d,", *opcode,len);
 311         for (icount = 3; (icount < wlength) && (icount < 24); icount++)
 312                 printk("%02x ", *(cmd_data+icount));
 313         printk("\n");
 314 }
 315
 316 static void print_command(struct sk_buff *skb)
 317 {
 318 #if PRINT_CMD_EVENT
 319         print_error_command(skb);
 320 #endif
 321 }
 322
 323 #if CONFIG_BLUEDROID
 324 /* Global parameters for bt usb char driver */
 325 #define BT_CHAR_DEVICE_NAME "rtk_btusb"
 326 struct mutex btchr_mutex;
 327 static struct sk_buff_head btchr_readq;
 328 static wait_queue_head_t btchr_read_wait;
 329 static int bt_char_dev_registered;
 330 static dev_t bt_devid; /* bt char device number */
 331 static struct cdev bt_char_dev; /* bt character device structure */
 332 static struct class *bt_char_class; /* device class for usb char driver */
 333 static int bt_reset = 0;
 334 /* HCI device & lock */
 335 DEFINE_RWLOCK(hci_dev_lock);
 336 struct hci_dev *ghdev = NULL;
 337
 338 static void print_event(struct sk_buff *skb)
 339 {
 340 #if PRINT_CMD_EVENT
 341         uint wlength = skb->len;
 342         uint icount = 0;
 343         u8 *opcode = (u8*)(skb->data);
 344         u8 len = *(opcode+1);
 345
 346         switch (*opcode) {
 347         case HCI_EV_INQUIRY_COMPLETE:
 348                 printk("HCI_EV_INQUIRY_COMPLETE");
 349                 break;
 350         case HCI_EV_INQUIRY_RESULT:
 351                 printk("HCI_EV_INQUIRY_RESULT");
 352                 break;
 353         case HCI_EV_CONN_COMPLETE:
 354                 printk("HCI_EV_CONN_COMPLETE");
 355                 break;
 356         case HCI_EV_CONN_REQUEST:
 357                 printk("HCI_EV_CONN_REQUEST");
 358                 break;
 359         case HCI_EV_DISCONN_COMPLETE:
 360                 printk("HCI_EV_DISCONN_COMPLETE");
 361                 break;
 362         case HCI_EV_AUTH_COMPLETE:
 363                 printk("HCI_EV_AUTH_COMPLETE");
 364                 break;
 365         case HCI_EV_REMOTE_NAME:
 366                 printk("HCI_EV_REMOTE_NAME");
 367                 break;
 368         case HCI_EV_ENCRYPT_CHANGE:
 369                 printk("HCI_EV_ENCRYPT_CHANGE");
 370                 break;
 371         case HCI_EV_CHANGE_LINK_KEY_COMPLETE:
 372                 printk("HCI_EV_CHANGE_LINK_KEY_COMPLETE");
 373                 break;
 374         case HCI_EV_REMOTE_FEATURES:
 375                 printk("HCI_EV_REMOTE_FEATURES");
 376                 break;
 377         case HCI_EV_REMOTE_VERSION:
 378                 printk("HCI_EV_REMOTE_VERSION");
 379                 break;
 380         case HCI_EV_QOS_SETUP_COMPLETE:
 381                 printk("HCI_EV_QOS_SETUP_COMPLETE");
 382                 break;
 383         case HCI_EV_CMD_COMPLETE:
 384                 printk("HCI_EV_CMD_COMPLETE");
 385                 break;
 386         case HCI_EV_CMD_STATUS:
 387                 printk("HCI_EV_CMD_STATUS");
 388                 break;
 389         case HCI_EV_ROLE_CHANGE:
 390                 printk("HCI_EV_ROLE_CHANGE");
 391                 break;
 392         case HCI_EV_NUM_COMP_PKTS:
 393                 printk("HCI_EV_NUM_COMP_PKTS");
 394                 break;
 395         case HCI_EV_MODE_CHANGE:
 396                 printk("HCI_EV_MODE_CHANGE");
 397                 break;
 398         case HCI_EV_PIN_CODE_REQ:
 399                 printk("HCI_EV_PIN_CODE_REQ");
 400                 break;
 401         case HCI_EV_LINK_KEY_REQ:
 402                 printk("HCI_EV_LINK_KEY_REQ");
 403                 break;
 404         case HCI_EV_LINK_KEY_NOTIFY:
 405                 printk("HCI_EV_LINK_KEY_NOTIFY");
 406                 break;
 407         case HCI_EV_CLOCK_OFFSET:
 408                 printk("HCI_EV_CLOCK_OFFSET");
 409                 break;
 410         case HCI_EV_PKT_TYPE_CHANGE:
 411                 printk("HCI_EV_PKT_TYPE_CHANGE");
 412                 break;
 413         case HCI_EV_PSCAN_REP_MODE:
 414                 printk("HCI_EV_PSCAN_REP_MODE");
 415                 break;
 416         case HCI_EV_INQUIRY_RESULT_WITH_RSSI:
 417                 printk("HCI_EV_INQUIRY_RESULT_WITH_RSSI");
 418                 break;
 419         case HCI_EV_REMOTE_EXT_FEATURES:
 420                 printk("HCI_EV_REMOTE_EXT_FEATURES");
 421                 break;
 422         case HCI_EV_SYNC_CONN_COMPLETE:
 423                 printk("HCI_EV_SYNC_CONN_COMPLETE");
 424                 break;
 425         case HCI_EV_SYNC_CONN_CHANGED:
 426                 printk("HCI_EV_SYNC_CONN_CHANGED");
 427                 break;
 428         case HCI_EV_SNIFF_SUBRATE:
 429                 printk("HCI_EV_SNIFF_SUBRATE");
 430                 break;
 431         case HCI_EV_EXTENDED_INQUIRY_RESULT:
 432                 printk("HCI_EV_EXTENDED_INQUIRY_RESULT");
 433                 break;
 434         case HCI_EV_IO_CAPA_REQUEST:
 435                 printk("HCI_EV_IO_CAPA_REQUEST");
 436                 break;
 437         case HCI_EV_SIMPLE_PAIR_COMPLETE:
 438                 printk("HCI_EV_SIMPLE_PAIR_COMPLETE");
 439                 break;
 440         case HCI_EV_REMOTE_HOST_FEATURES:
 441                 printk("HCI_EV_REMOTE_HOST_FEATURES");
 442                 break;
 443         default:
 444                 printk("event");
 445                 break;
 446         }
 447         printk(":%02x,len:%d,", *opcode,len);
 448         for (icount = 2; (icount < wlength) && (icount < 24); icount++)
 449                 printk("%02x ", *(opcode+icount));
 450         printk("\n");
 451 #endif
 452 }
 453
 454 static inline ssize_t usb_put_user(struct sk_buff *skb,
 455                 char __user *buf, int count)
 456 {
 457         char __user *ptr = buf;
 458         int len = min_t(unsigned int, skb->len, count);
 459
 460         if (copy_to_user(ptr, skb->data, len))
 461                 return -EFAULT;
 462
 463         return len;
 464 }
 465
 466 static struct sk_buff *rtk_skb_queue[QUEUE_SIZE];
 467 static int rtk_skb_queue_front = -1;
 468 static int rtk_skb_queue_rear = -1;
 469
 470 static void rtk_enqueue(struct sk_buff *skb)
 471 {
 472         if (rtk_skb_queue_front == (rtk_skb_queue_rear + 1) % QUEUE_SIZE) {
 473                 /*
 474                  * If queue is full, current solution is to drop
 475                  * the following entries.
 476                  */
 477                 RTKBT_WARN("%s: Queue is full, entry will be dropped", __func__);
 478         } else {
 479                 if (rtk_skb_queue_front == -1) {
 480                         rtk_skb_queue_front = 0;
 481                         rtk_skb_queue_rear = 0;
 482                 } else {
 483                         rtk_skb_queue_rear++;
 484                         rtk_skb_queue_rear %= QUEUE_SIZE;
 485                 }
 486
 487                 rtk_skb_queue[rtk_skb_queue_rear] = skb;
 488         }
 489 }
 490
 491 static struct sk_buff *rtk_dequeue_try(unsigned int deq_len)
 492 {
 493         struct sk_buff *skb;
 494         struct sk_buff *skb_copy;
 495
 496         if (rtk_skb_queue_front == -1) {
 497                 RTKBT_WARN("%s: Queue is empty", __func__);
 498                 return NULL;
 499         }
 500
 501         skb = rtk_skb_queue[rtk_skb_queue_front];
 502         if (deq_len >= skb->len) {
 503                 if (rtk_skb_queue_front == rtk_skb_queue_rear) {
 504                         rtk_skb_queue_front = -1;
 505                         rtk_skb_queue_rear = -1;
 506                 } else {
 507                         rtk_skb_queue_front++;
 508                         rtk_skb_queue_front %= QUEUE_SIZE;
 509                 }
 510                 /*
 511                  * Return skb addr to be dequeued, and the caller
 512                  * should free the skb eventually.
 513                  */
 514                 return skb;
 515         } else {
 516                 skb_copy = pskb_copy(skb, GFP_ATOMIC);
 517                 skb_pull(skb, deq_len);
 518                 /* Return its copy to be freed */
 519                 return skb_copy;
 520         }
 521 }
 522
 523 static inline int is_queue_empty(void)
 524 {
 525         return (rtk_skb_queue_front == -1) ? 1 : 0;
 526 }
 527
 528 /*
 529  * Realtek - Integrate from hci_core.c
 530  */
 531
 532 /* Get HCI device by index.
 533  * Device is held on return. */
 534 static struct hci_dev *hci_dev_get(int index)
 535 {
 536         if (index != 0)
 537                 return NULL;
 538
 539         return ghdev;
 540 }
 541
 542 /* ---- HCI ioctl helpers ---- */
 543 static int hci_dev_open(__u16 dev)
 544 {
 545         struct hci_dev *hdev;
 546         int ret = 0;
 547
 548         RTKBT_DBG("%s: dev %d", __func__, dev);
 549
 550         hdev = hci_dev_get(dev);
 551         if (!hdev) {
 552                 RTKBT_ERR("%s: Failed to get hci dev[Null]", __func__);
 553                 return -ENODEV;
 554         }
 555
 556         if (test_bit(HCI_UNREGISTER, &hdev->dev_flags)) {
 557                 ret = -ENODEV;
 558                 goto done;
 559         }
 560
 561         if (test_bit(HCI_UP, &hdev->flags)) {
 562                 ret = -EALREADY;
 563                 goto done;
 564         }
 565
 566         if (hdev->open(hdev)) {
 567                 ret = -EIO;
 568                 goto done;
 569         }
 570
 571         set_bit(HCI_UP, &hdev->flags);
 572 done:
 573         return ret;
 574 }
 575
 576 static int hci_dev_do_close(struct hci_dev *hdev)
 577 {
 578         if (hdev->flush)
 579                 hdev->flush(hdev);
 580         /* After this point our queues are empty
 581          * and no tasks are scheduled. */
 582         hdev->close(hdev);
 583         /* Clear flags */
 584         hdev->flags = 0;
 585         return 0;
 586 }
 587
 588 static int hci_dev_close(__u16 dev)
 589 {
 590         struct hci_dev *hdev;
 591         int err;
 592         hdev = hci_dev_get(dev);
 593         if (!hdev) {
 594                 RTKBT_ERR("%s: failed to get hci dev[Null]", __func__);
 595                 return -ENODEV;
 596         }
 597
 598         err = hci_dev_do_close(hdev);
 599
 600         return err;
 601 }
 602
 603 static struct hci_dev *hci_alloc_dev(void)
 604 {
 605         struct hci_dev *hdev;
 606
 607         hdev = kzalloc(sizeof(struct hci_dev), GFP_KERNEL);
 608         if (!hdev)
 609                 return NULL;
 610
 611         return hdev;
 612 }
 613
 614 /* Free HCI device */
 615 static void hci_free_dev(struct hci_dev *hdev)
 616 {
 617         kfree(hdev);
 618 }
 619
 620 /* Register HCI device */
 621 static int hci_register_dev(struct hci_dev *hdev)
 622 {
 623         int i, id;
 624
 625         RTKBT_DBG("%s: %p name %s bus %d", __func__, hdev, hdev->name, hdev->bus);
 626         /* Do not allow HCI_AMP devices to register at index 0,
 627          * so the index can be used as the AMP controller ID.
 628          */
 629         id = (hdev->dev_type == HCI_BREDR) ? 0 : 1;
 630
 631         write_lock(&hci_dev_lock);
 632
 633         sprintf(hdev->name, "hci%d", id);
 634         hdev->id = id;
 635         hdev->flags = 0;
 636         hdev->dev_flags = 0;
 637         mutex_init(&hdev->lock);
 638
 639         RTKBT_DBG("%s: id %d, name %s", __func__, hdev->id, hdev->name);
 640
 641
 642         for (i = 0; i < NUM_REASSEMBLY; i++)
 643                 hdev->reassembly[i] = NULL;
 644
 645         memset(&hdev->stat, 0, sizeof(struct hci_dev_stats));
 646         atomic_set(&hdev->promisc, 0);
 647
 648         if (ghdev) {
 649                 RTKBT_ERR("%s: Hci device has been registered already", __func__);
 650                 return -1;
 651         } else
 652                 ghdev = hdev;
 653
 654         write_unlock(&hci_dev_lock);
 655
 656         return id;
 657 }
 658
 659 /* Unregister HCI device */
 660 static void hci_unregister_dev(struct hci_dev *hdev)
 661 {
 662         int i;
 663
 664         RTKBT_DBG("%s: hdev %p name %s bus %d", __func__, hdev, hdev->name, hdev->bus);
 665         set_bit(HCI_UNREGISTER, &hdev->dev_flags);
 666
 667         write_lock(&hci_dev_lock);
 668         ghdev = NULL;
 669         write_unlock(&hci_dev_lock);
 670
 671         hci_dev_do_close(hdev);
 672         for (i = 0; i < NUM_REASSEMBLY; i++)
 673                 kfree_skb(hdev->reassembly[i]);
 674 }
 675
 676 static void hci_send_to_stack(struct hci_dev *hdev, struct sk_buff *skb)
 677 {
 678         struct sk_buff *rtk_skb_copy = NULL;
 679
 680         RTKBT_DBG("%s", __func__);
 681
 682         if (!hdev) {
 683                 RTKBT_ERR("%s: Frame for unknown HCI device", __func__);
 684                 return;
 685         }
 686
 687         if (!test_bit(HCI_RUNNING, &hdev->flags)) {
 688                 RTKBT_ERR("%s: HCI not running", __func__);
 689                 return;
 690         }
 691
 692         rtk_skb_copy = pskb_copy(skb, GFP_ATOMIC);
 693         if (!rtk_skb_copy) {
 694                 RTKBT_ERR("%s: Copy skb error", __func__);
 695                 return;
 696         }
 697
 698         memcpy(skb_push(rtk_skb_copy, 1), &bt_cb(skb)->pkt_type, 1);
 699         rtk_enqueue(rtk_skb_copy);
 700
 701         /* Make sure bt char device existing before wakeup read queue */
 702         hdev = hci_dev_get(0);
 703         if (hdev) {
 704                 RTKBT_DBG("%s: Try to wakeup read queue", __func__);
 705                 wake_up_interruptible(&btchr_read_wait);
 706         }
 707
 708         return;
 709 }
 710
 711 /* Receive frame from HCI drivers */
 712 static int hci_recv_frame(struct sk_buff *skb)
 713 {
 714         struct hci_dev *hdev = (struct hci_dev *) skb->dev;
 715
 716         if (!hdev ||
 717                 (!test_bit(HCI_UP, &hdev->flags) && !test_bit(HCI_INIT, &hdev->flags))) {
 718                 kfree_skb(skb);
 719                 return -ENXIO;
 720         }
 721
 722         /* Incomming skb */
 723         bt_cb(skb)->incoming = 1;
 724
 725         /* Time stamp */
 726         __net_timestamp(skb);
 727
 728         if (atomic_read(&hdev->promisc)) {
 729                 /* Send copy to the sockets */
 730                 hci_send_to_stack(hdev, skb);
 731         }
 732         kfree_skb(skb);
 733         return 0;
 734 }
 735
 736 static int hci_reassembly(struct hci_dev *hdev, int type, void *data,
 737                                                   int count, __u8 index)
 738 {
 739         int len = 0;
 740         int hlen = 0;
 741         int remain = count;
 742         struct sk_buff *skb;
 743         struct bt_skb_cb *scb;
 744
 745         RTKBT_DBG("%s", __func__);
 746
 747         if ((type < HCI_ACLDATA_PKT || type > HCI_EVENT_PKT) ||
 748                         index >= NUM_REASSEMBLY)
 749                 return -EILSEQ;
 750
 751         skb = hdev->reassembly[index];
 752
 753         if (!skb) {
 754                 switch (type) {
 755                 case HCI_ACLDATA_PKT:
 756                         len = HCI_MAX_FRAME_SIZE;
 757                         hlen = HCI_ACL_HDR_SIZE;
 758                         break;
 759                 case HCI_EVENT_PKT:
 760                         len = HCI_MAX_EVENT_SIZE;
 761                         hlen = HCI_EVENT_HDR_SIZE;
 762                         break;
 763                 case HCI_SCODATA_PKT:
 764                         len = HCI_MAX_SCO_SIZE;
 765                         hlen = HCI_SCO_HDR_SIZE;
 766                         break;
 767                 }
 768
 769                 skb = bt_skb_alloc(len, GFP_ATOMIC);
 770                 if (!skb)
 771                         return -ENOMEM;
 772
 773                 scb = (void *) skb->cb;
 774                 scb->expect = hlen;
 775                 scb->pkt_type = type;
 776
 777                 skb->dev = (void *) hdev;
 778                 hdev->reassembly[index] = skb;
 779         }
 780
 781         while (count) {
 782                 scb = (void *) skb->cb;
 783                 len = min_t(uint, scb->expect, count);
 784
 785                 memcpy(skb_put(skb, len), data, len);
 786
 787                 count -= len;
 788                 data += len;
 789                 scb->expect -= len;
 790                 remain = count;
 791
 792                 switch (type) {
 793                 case HCI_EVENT_PKT:
 794                         if (skb->len == HCI_EVENT_HDR_SIZE) {
 795                                 struct hci_event_hdr *h = hci_event_hdr(skb);
 796                                 scb->expect = h->plen;
 797
 798                                 if (skb_tailroom(skb) < scb->expect) {
 799                                         kfree_skb(skb);
 800                                         hdev->reassembly[index] = NULL;
 801                                         return -ENOMEM;
 802                                 }
 803                         }
 804                         break;
 805
 806                 case HCI_ACLDATA_PKT:
 807                         if (skb->len  == HCI_ACL_HDR_SIZE) {
 808                                 struct hci_acl_hdr *h = hci_acl_hdr(skb);
 809                                 scb->expect = __le16_to_cpu(h->dlen);
 810
 811                                 if (skb_tailroom(skb) < scb->expect) {
 812                                         kfree_skb(skb);
 813                                         hdev->reassembly[index] = NULL;
 814                                         return -ENOMEM;
 815                                 }
 816                         }
 817                         break;
 818
 819                 case HCI_SCODATA_PKT:
 820                         if (skb->len == HCI_SCO_HDR_SIZE) {
 821                                 struct hci_sco_hdr *h = hci_sco_hdr(skb);
 822                                 scb->expect = h->dlen;
 823
 824                                 if (skb_tailroom(skb) < scb->expect) {
 825                                         kfree_skb(skb);
 826                                         hdev->reassembly[index] = NULL;
 827                                         return -ENOMEM;
 828                                 }
 829                         }
 830                         break;
 831                 }
 832
 833                 if (scb->expect == 0) {
 834                         /* Complete frame */
 835                         if(HCI_ACLDATA_PKT == type)
 836                                 print_acl(skb,0);
 837                         if(HCI_SCODATA_PKT == type)
 838                                 print_sco(skb,0);
 839                         if(HCI_EVENT_PKT == type)
 840                                 print_event(skb);
 841
 842                         bt_cb(skb)->pkt_type = type;
 843                         hci_recv_frame(skb);
 844
 845                         hdev->reassembly[index] = NULL;
 846                         return remain;
 847                 }
 848         }
 849
 850         return remain;
 851 }
 852
 853 static int hci_recv_fragment(struct hci_dev *hdev, int type, void *data, int count)
 854 {
 855         int rem = 0;
 856
 857         if (type < HCI_ACLDATA_PKT || type > HCI_EVENT_PKT)
 858                 return -EILSEQ;
 859
 860         while (count) {
 861                 rem = hci_reassembly(hdev, type, data, count, type - 1);
 862                 if (rem < 0)
 863                         return rem;
 864
 865                 data += (count - rem);
 866                 count = rem;
 867         }
 868
 869         return rem;
 870 }
 871
 872 void hci_hardware_error(void)
 873 {
 874         struct sk_buff *rtk_skb_copy = NULL;
 875         int len = 3;
 876         uint8_t hardware_err_pkt[3] = {HCI_EVENT_PKT, 0x10, 0x00};
 877
 878         rtk_skb_copy = alloc_skb(len, GFP_ATOMIC);
 879         if (!rtk_skb_copy) {
 880                 RTKBT_ERR("%s: Failed to allocate mem", __func__);
 881                 return;
 882         }
 883
 884         memcpy(skb_put(rtk_skb_copy, len), hardware_err_pkt, len);
 885         rtk_enqueue(rtk_skb_copy);
 886
 887         wake_up_interruptible(&btchr_read_wait);
 888 }
 889
 890 static int btchr_open(struct inode *inode_p, struct file  *file_p)
 891 {
 892         struct btusb_data *data;
 893         struct hci_dev *hdev;
 894
 895         RTKBT_INFO("%s: BT usb char device is opening", __func__);
 896         /* Not open unless wanna tracing log */
 897         /* trace_printk("%s: open....\n", __func__); */
 898
 899         hdev = hci_dev_get(0);
 900         if (!hdev) {
 901                 RTKBT_ERR("%s: Failed to get hci dev[NULL]", __func__);
 902                 return -1;
 903         }
 904         data = GET_DRV_DATA(hdev);
 905
 906         atomic_inc(&hdev->promisc);
 907         /*
 908          * As bt device is not re-opened when hotplugged out, we cannot
 909          * trust on file's private data(may be null) when other file ops
 910          * are invoked.
 911          */
 912         file_p->private_data = data;
 913
 914         mutex_lock(&btchr_mutex);
 915         hci_dev_open(0);
 916         mutex_unlock(&btchr_mutex);
 917
 918         return nonseekable_open(inode_p, file_p);
 919 }
 920
 921 static int btchr_close(struct inode  *inode_p, struct file   *file_p)
 922 {
 923         struct btusb_data *data;
 924         struct hci_dev *hdev;
 925
 926         RTKBT_INFO("%s: BT usb char device is closing", __func__);
 927         /* Not open unless wanna tracing log */
 928         /* trace_printk("%s: close....\n", __func__); */
 929
 930         data = file_p->private_data;
 931         file_p->private_data = NULL;
 932
 933 #if CONFIG_BLUEDROID
 934         /*
 935          * If the upper layer closes bt char interfaces, no reset
 936          * action required even bt device hotplugged out.
 937          */
 938         bt_reset = 0;
 939 #endif
 940
 941         hdev = hci_dev_get(0);
 942         if (hdev) {
 943                 atomic_set(&hdev->promisc, 0);
 944                 mutex_lock(&btchr_mutex);
 945                 hci_dev_close(0);
 946                 mutex_unlock(&btchr_mutex);
 947         }
 948
 949         return 0;
 950 }
 951
 952 static ssize_t btchr_read(struct file *file_p,
 953                 char __user *buf_p,
 954                 size_t count,
 955                 loff_t *pos_p)
 956 {
 957         struct hci_dev *hdev;
 958         struct sk_buff *skb;
 959         ssize_t ret = 0;
 960
 961         RTKBT_DBG("%s: BT usb char device is reading", __func__);
 962
 963         while (count) {
 964                 hdev = hci_dev_get(0);
 965                 if (!hdev) {
 966                         /*
 967                          * Note: Only when BT device hotplugged out, we wil get
 968                          * into such situation. In order to keep the upper layer
 969                          * stack alive (blocking the read), we should never return
 970                          * EFAULT or break the loop.
 971                          */
 972                         RTKBT_ERR("%s: Failed to get hci dev[Null]", __func__);
 973                 }
 974
 975                 ret = wait_event_interruptible(btchr_read_wait, !is_queue_empty());
 976                 if (ret < 0) {
 977                         RTKBT_ERR("%s: wait event is signaled %d", __func__, ret);
 978                         break;
 979                 }
 980
 981                 skb = rtk_dequeue_try(count);
 982                 if (skb) {
 983                         ret = usb_put_user(skb, buf_p, count);
 984                         if (ret < 0)
 985                                 RTKBT_ERR("%s: Failed to put data to user space", __func__);
 986                         kfree_skb(skb);
 987                         break;
 988                 }
 989         }
 990
 991         return ret;
 992 }
 993
 994 static ssize_t btchr_write(struct file *file_p,
 995                 const char __user *buf_p,
 996                 size_t count,
 997                 loff_t *pos_p)
 998 {
 999         struct btusb_data *data = file_p->private_data;
1000         struct hci_dev *hdev;
1001         struct sk_buff *skb;
1002
1003         RTKBT_DBG("%s: BT usb char device is writing", __func__);
1004
1005         hdev = hci_dev_get(0);
1006         if (!hdev) {
1007                 RTKBT_WARN("%s: Failed to get hci dev[Null]", __func__);
1008                 /*
1009                  * Note: we bypass the data from the upper layer if bt device
1010                  * is hotplugged out. Fortunatelly, H4 or H5 HCI stack does
1011                  * NOT check btchr_write's return value. However, returning
1012                  * count instead of EFAULT is preferable.
1013                  */
1014                 /* return -EFAULT; */
1015                 return count;
1016         }
1017
1018         /* Never trust on btusb_data, as bt device may be hotplugged out */
1019         data = GET_DRV_DATA(hdev);
1020         if (!data) {
1021                 RTKBT_WARN("%s: Failed to get bt usb driver data[Null]", __func__);
1022                 return count;
1023         }
1024
1025         if (count > HCI_MAX_FRAME_SIZE)
1026                 return -EINVAL;
1027
1028         skb = bt_skb_alloc(count, GFP_ATOMIC);
1029         if (!skb)
1030                 return -ENOMEM;
1031         skb_reserve(skb, -1); // Add this line
1032
1033         if (copy_from_user(skb_put(skb, count), buf_p, count)) {
1034                 RTKBT_ERR("%s: Failed to get data from user space", __func__);
1035                 kfree_skb(skb);
1036                 return -EFAULT;
1037         }
1038
1039         skb->dev = (void *)hdev;
1040         bt_cb(skb)->pkt_type = *((__u8 *)skb->data);
1041         skb_pull(skb, 1);
1042         data->hdev->send(skb);
1043
1044         return count;
1045 }
1046
1047 static unsigned int btchr_poll(struct file *file_p, poll_table *wait)
1048 {
1049         struct btusb_data *data = file_p->private_data;
1050         struct hci_dev *hdev;
1051
1052         RTKBT_DBG("%s: BT usb char device is polling", __func__);
1053
1054         hdev = hci_dev_get(0);
1055         if (!hdev) {
1056                 RTKBT_ERR("%s: Failed to get hci dev[Null]", __func__);
1057                 mdelay(URB_CANCELING_DELAY_MS);
1058                 return POLLOUT | POLLWRNORM;
1059         }
1060
1061         /* Never trust on btusb_data, as bt device may be hotplugged out */
1062         data = GET_DRV_DATA(hdev);
1063         if (!data) {
1064                 /*
1065                  * When bt device is hotplugged out, btusb_data will
1066                  * be freed in disconnect.
1067                  */
1068                 RTKBT_ERR("%s: Failed to get bt usb driver data[Null]", __func__);
1069                 mdelay(URB_CANCELING_DELAY_MS);
1070                 return POLLOUT | POLLWRNORM;
1071         }
1072
1073         if (!is_queue_empty())
1074                 return POLLIN | POLLRDNORM;
1075
1076         poll_wait(file_p, &btchr_read_wait, wait);
1077
1078         return POLLOUT | POLLWRNORM;
1079 }
1080
1081 static struct file_operations bt_chrdev_ops  = {
1082         open    :       btchr_open,
1083         release :       btchr_close,
1084         read    :       btchr_read,
1085         write   :       btchr_write,
1086         poll    :       btchr_poll
1087 };
1088
1089 static int btchr_init(void)
1090 {
1091         int res = 0;
1092         struct device *dev;
1093
1094         RTKBT_INFO("Register usb char device interface for BT driver");
1095         /*
1096          * btchr mutex is used to sync between
1097          * 1) downloading patch and opening bt char driver
1098          * 2) the file operations of bt char driver
1099          */
1100         mutex_init(&btchr_mutex);
1101
1102         skb_queue_head_init(&btchr_readq);
1103         init_waitqueue_head(&btchr_read_wait);
1104
1105         bt_char_class = class_create(THIS_MODULE, BT_CHAR_DEVICE_NAME);
1106         if (IS_ERR(bt_char_class)) {
1107                 RTKBT_ERR("Failed to create bt char class");
1108                 return PTR_ERR(bt_char_class);
1109         }
1110
1111         res = alloc_chrdev_region(&bt_devid, 0, 1, BT_CHAR_DEVICE_NAME);
1112         if (res < 0) {
1113                 RTKBT_ERR("Failed to allocate bt char device");
1114                 goto err_alloc;
1115         }
1116
1117         dev = device_create(bt_char_class, NULL, bt_devid, NULL, BT_CHAR_DEVICE_NAME);
1118         if (IS_ERR(dev)) {
1119                 RTKBT_ERR("Failed to create bt char device");
1120                 res = PTR_ERR(dev);
1121                 goto err_create;
1122         }
1123
1124         cdev_init(&bt_char_dev, &bt_chrdev_ops);
1125         res = cdev_add(&bt_char_dev, bt_devid, 1);
1126         if (res < 0) {
1127                 RTKBT_ERR("Failed to add bt char device");
1128                 goto err_add;
1129         }
1130
1131         return 0;
1132
1133 err_add:
1134         device_destroy(bt_char_class, bt_devid);
1135 err_create:
1136         unregister_chrdev_region(bt_devid, 1);
1137 err_alloc:
1138         class_destroy(bt_char_class);
1139         return res;
1140 }
1141
1142 static void btchr_exit(void)
1143 {
1144         RTKBT_INFO("Unregister usb char device interface for BT driver");
1145
1146         device_destroy(bt_char_class, bt_devid);
1147         cdev_del(&bt_char_dev);
1148         unregister_chrdev_region(bt_devid, 1);
1149         class_destroy(bt_char_class);
1150
1151         return;
1152 }
1153 #endif
1154
1155 int send_hci_cmd(firmware_info *fw_info)
1156 {
1157         int ret_val;
1158
1159         ret_val = usb_control_msg(
1160                 fw_info->udev, fw_info->pipe_out,
1161                 0, USB_TYPE_CLASS, 0, 0,
1162                 (void *)(fw_info->send_pkt),
1163                 fw_info->pkt_len, MSG_TO);
1164
1165         return ret_val;
1166 }
1167
1168 int rcv_hci_evt(firmware_info *fw_info)
1169 {
1170         int ret_len = 0, ret_val = 0;
1171         int i;
1172
1173         while (1) {
1174                 for(i = 0; i < 5; i++) {
1175                 ret_val = usb_interrupt_msg(
1176                         fw_info->udev, fw_info->pipe_in,
1177                         (void *)(fw_info->rcv_pkt), PKT_LEN,
1178                         &ret_len, MSG_TO);
1179                         if (ret_val >= 0)
1180                                 break;
1181                 }
1182
1183                 if (ret_val < 0)
1184                         return ret_val;
1185
1186                 if (CMD_CMP_EVT == fw_info->evt_hdr->evt) {
1187                         if (fw_info->cmd_hdr->opcode == fw_info->cmd_cmp->opcode)
1188                                 return ret_len;
1189                 }
1190         }
1191 }
1192
1193 int set_bt_onoff(firmware_info *fw_info, uint8_t onoff)
1194 {
1195         patch_info *patch_entry;
1196         int ret_val;
1197
1198         RTKBT_INFO("%s: %s", __func__, onoff != 0 ? "on" : "off");
1199
1200         patch_entry = fw_info->patch_entry;
1201         if (!patch_entry)
1202                 return -1;
1203
1204         fw_info->cmd_hdr->opcode = cpu_to_le16(BTOFF_OPCODE);
1205         fw_info->cmd_hdr->plen = 1;
1206         fw_info->pkt_len = CMD_HDR_LEN + 1;
1207         fw_info->send_pkt[CMD_HDR_LEN] = onoff;
1208
1209         ret_val = send_hci_cmd(fw_info);
1210         if (ret_val < 0) {
1211                 RTKBT_ERR("%s: Failed to send bt %s cmd, errno %d",
1212                                 __func__, onoff != 0 ? "on" : "off", ret_val);
1213                 return ret_val;
1214         }
1215
1216         ret_val = rcv_hci_evt(fw_info);
1217         if (ret_val < 0) {
1218                 RTKBT_ERR("%s: Failed to receive bt %s event, errno %d",
1219                                 __func__, onoff != 0 ? "on" : "off", ret_val);
1220                 return ret_val;
1221         }
1222
1223         return ret_val;
1224 }
1225
1226 static patch_info *get_fw_table_entry(struct usb_device* udev)
1227 {
1228         patch_info *patch_entry = fw_patch_table;
1229         uint16_t pid = le16_to_cpu(udev->descriptor.idProduct);
1230         uint32_t entry_size = sizeof(fw_patch_table) / sizeof(fw_patch_table[0]);
1231         uint32_t i;
1232
1233         RTKBT_INFO("%s: Product id = 0x%04x, fw table entry size %d", __func__, pid, entry_size);
1234
1235         for (i = 0; i < entry_size; i++, patch_entry++) {
1236                 if (pid == patch_entry->prod_id)
1237                         break;
1238         }
1239
1240         if (i == entry_size) {
1241                 RTKBT_ERR("%s: No fw table entry found", __func__);
1242                 return NULL;
1243         }
1244
1245         return patch_entry;
1246 }
1247
1248 static struct rtk_epatch_entry *get_fw_patch_entry(struct rtk_epatch *epatch_info, uint16_t eco_ver)
1249 {
1250         int patch_num = epatch_info->number_of_total_patch;
1251         uint8_t *epatch_buf = (uint8_t *)epatch_info;
1252         struct rtk_epatch_entry *p_entry = NULL;
1253         int coex_date;
1254         int coex_ver;
1255         int i;
1256
1257         for (i = 0; i < patch_num; i++) {
1258                 if (*(uint16_t *)(epatch_buf + 14 + 2*i) == eco_ver + 1) {
1259                         p_entry = kzalloc(sizeof(*p_entry), GFP_KERNEL);
1260                         if (!p_entry) {
1261                                 RTKBT_ERR("%s: Failed to allocate mem for patch entry", __func__);
1262                                 return NULL;
1263                         }
1264                         p_entry->chip_id = eco_ver + 1;
1265                         p_entry->patch_length = *(uint16_t*)(epatch_buf + 14 + 2*patch_num + 2*i);
1266                         p_entry->start_offset = *(uint32_t*)(epatch_buf + 14 + 4*patch_num + 4*i);
1267                         p_entry->coex_version = *(uint32_t*)(epatch_buf + p_entry->start_offset + p_entry->patch_length - 12);
1268                         p_entry->svn_version = *(uint32_t*)(epatch_buf + p_entry->start_offset + p_entry->patch_length - 8);
1269                         p_entry->fw_version = *(uint32_t*)(epatch_buf + p_entry->start_offset + p_entry->patch_length - 4);
1270
1271                         coex_date = ((p_entry->coex_version >> 16) & 0x7ff) + ((p_entry->coex_version >> 27) * 10000);
1272                         coex_ver = p_entry->coex_version & 0xffff;
1273
1274                         RTKBT_INFO("%s: chip id %d, patch length 0x%04x, patch offset 0x%08x, "
1275                                         "coex version 20%06d-0x%04x, svn version 0x%08x, fw version 0x%08x",
1276                                         __func__, p_entry->chip_id, p_entry->patch_length, p_entry->start_offset,
1277                                         coex_date, coex_ver, p_entry->svn_version, p_entry->fw_version);
1278                         break;
1279                 }
1280         }
1281
1282         return p_entry;
1283 }
1284
1285 /*
1286  * check the return value
1287  * 1: need to download fw patch
1288  * 0: no need to download fw patch
1289  * <0: failed to check lmp version
1290  */
1291 int check_fw_version(firmware_info* fw_info)
1292 {
1293         struct hci_rp_read_local_version *read_ver_rsp;
1294         patch_info *patch_entry = NULL;
1295         int ret_val = -1;
1296
1297         fw_info->cmd_hdr->opcode = cpu_to_le16(HCI_OP_READ_LOCAL_VERSION);
1298         fw_info->cmd_hdr->plen = 0;
1299         fw_info->pkt_len = CMD_HDR_LEN;
1300
1301         ret_val = send_hci_cmd(fw_info);
1302         if (ret_val < 0) {
1303                 RTKBT_ERR("%s: Failed to send hci cmd 0x%04x, errno %d",
1304                                 __func__, fw_info->cmd_hdr->opcode, ret_val);
1305                 return ret_val;
1306         }
1307
1308         ret_val = rcv_hci_evt(fw_info);
1309         if (ret_val < 0) {
1310                 RTKBT_ERR("%s: Failed to receive hci event, errno %d",
1311                                 __func__, ret_val);
1312                 return ret_val;
1313         }
1314
1315         patch_entry = fw_info->patch_entry;
1316         read_ver_rsp = (struct hci_rp_read_local_version *)(fw_info->rsp_para);
1317
1318         RTKBT_INFO("%s: Controller lmp = 0x%04x, patch lmp = 0x%04x, default patch lmp = 0x%04x",
1319                         __func__, read_ver_rsp->lmp_subver, patch_entry->lmp_sub, patch_entry->lmp_sub_default);
1320
1321         if (read_ver_rsp->lmp_subver == patch_entry->lmp_sub_default) {
1322                 RTKBT_INFO("%s: Cold BT controller startup", __func__);
1323                 return 1;
1324         } else if (read_ver_rsp->lmp_subver != patch_entry->lmp_sub) {
1325                 RTKBT_INFO("%s: Warm BT controller startup with updated lmp", __func__);
1326                 return 1;
1327         } else {
1328                 RTKBT_INFO("%s: Warm BT controller startup with same lmp", __func__);
1329                 return 0;
1330         }
1331 }
1332
1333 int get_eversion(firmware_info* fw_info)
1334 {
1335         struct rtk_eversion_evt *ever_evt;
1336         int ret_val;
1337
1338         if (!fw_info)
1339                 return -ENODEV;
1340
1341         fw_info->cmd_hdr->opcode = cpu_to_le16(HCI_VENDOR_READ_RTK_ROM_VERISION);
1342         fw_info->cmd_hdr->plen = 0;
1343         fw_info->pkt_len = CMD_HDR_LEN;
1344
1345         ret_val = send_hci_cmd(fw_info);
1346         if (ret_val < 0) {
1347                 RTKBT_ERR("%s: Failed to send hci cmd 0x%04x, errno %d",
1348                                 __func__, fw_info->cmd_hdr->opcode, ret_val);
1349                 return ret_val;
1350         }
1351
1352         ret_val = rcv_hci_evt(fw_info);
1353         if (ret_val < 0) {
1354                 RTKBT_ERR("%s: Failed to receive hci event, errno %d",
1355                                 __func__, ret_val);
1356                 return ret_val;
1357         }
1358
1359         ever_evt = (struct rtk_eversion_evt *)(fw_info->rsp_para);
1360
1361         RTKBT_INFO("%s: status %d, eversion %d", __func__, ever_evt->status, ever_evt->version);
1362
1363         if (ever_evt->status)
1364                 fw_info->patch_entry->eversion = 0;
1365         else
1366                 fw_info->patch_entry->eversion = ever_evt->version;
1367
1368         return ret_val;
1369 }
1370
1371 int load_firmware(firmware_info *fw_info, uint8_t **buff)
1372 {
1373         const struct firmware *fw, *cfg;
1374         struct usb_device *udev;
1375         patch_info *patch_entry;
1376         char *config_name, *fw_name;
1377         int fw_len = 0;
1378         int ret_val;
1379
1380         int config_len = 0, buf_len = -1;
1381         uint8_t *buf = *buff, *config_file_buf = NULL;
1382         uint8_t *epatch_buf = NULL;
1383
1384         struct rtk_epatch *epatch_info = NULL;
1385         uint8_t need_download_fw = 1;
1386         struct rtk_extension_entry patch_lmp = {0};
1387         struct rtk_epatch_entry *p_epatch_entry = NULL;
1388         uint16_t lmp_version;
1389         //uint8_t use_mp_fw = 0;
1390         RTKBT_DBG("%s: start", __func__);
1391
1392         udev = fw_info->udev;
1393         patch_entry = fw_info->patch_entry;
1394         lmp_version = patch_entry->lmp_sub_default;
1395         config_name = patch_entry->config_name;
1396         fw_name = patch_entry->patch_name;
1397
1398         RTKBT_INFO("%s: Default lmp version = 0x%04x, config file name[%s], "
1399                         "fw file name[%s]", __func__, lmp_version,config_name, fw_name);
1400
1401 /*      ret_val = request_firmware(&cfg, "mp_test", &udev->dev);
1402         if (ret_val > 0)
1403                 config_file_buf = kzalloc(cfg->size, GFP_KERNEL);
1404                 if (config_file_buf) {
1405                         memcpy(config_file_buf, cfg->data, cfg->size);
1406                         use_mp_fw = *config_file_buf;
1407                         if (1 == use_mp_fw){
1408                                 fw_name = patch_entry->mp_patch_name;
1409                                 RTKBT_WARN("%s: use_mp_fw = %04d, fw file name[%s]", __func__, use_mp_fw,  fw_name);
1410                         }
1411                         kfree(config_file_buf);
1412                         release_firmware(cfg);
1413                 }
1414 */
1415         ret_val = request_firmware(&cfg, config_name, &udev->dev);
1416         if (ret_val < 0)
1417                 config_len = 0;
1418         else {
1419                 config_file_buf = kzalloc(cfg->size, GFP_KERNEL);
1420                 if (!config_file_buf)
1421                         return -ENOMEM;
1422                 memcpy(config_file_buf, cfg->data, cfg->size);
1423                 config_len = cfg->size;
1424                 release_firmware(cfg);
1425         }
1426
1427         ret_val = request_firmware(&fw, fw_name, &udev->dev);
1428         if (ret_val < 0)
1429                 goto fw_fail;
1430         else {
1431                 epatch_buf = kzalloc(fw->size, GFP_KERNEL);
1432                 if (!epatch_buf) {
1433                         release_firmware(fw);
1434                         goto fw_fail;
1435                 }
1436                 memcpy(epatch_buf, fw->data, fw->size);
1437                 fw_len = fw->size;
1438                 buf_len = fw_len + config_len;
1439                 release_firmware(fw);
1440         }
1441
1442         if (lmp_version == ROM_LMP_8723a) {
1443                 RTKBT_DBG("%s: 8723a -> use old style patch", __func__);
1444                 if (!memcmp(epatch_buf, RTK_EPATCH_SIGNATURE, 8)) {
1445                         RTKBT_ERR("%s: 8723a check signature error", __func__);
1446                         need_download_fw = 0;
1447                 } else {
1448                         if (!(buf = kzalloc(buf_len, GFP_KERNEL))) {
1449                                 RTKBT_ERR("%s: Failed to allocate mem for fw&config", __func__);
1450                                 buf_len = -1;
1451                         } else {
1452                                 RTKBT_DBG("%s: 8723a -> fw copy directly", __func__);
1453                                 memcpy(buf, epatch_buf, buf_len);
1454                                 patch_entry->lmp_sub = *(uint16_t *)(buf + buf_len - config_len - 4);
1455                                 RTKBT_DBG("%s: Config lmp version = 0x%04x", __func__,
1456                                                 patch_entry->lmp_sub);
1457                                 kfree(epatch_buf);
1458                                 epatch_buf = NULL;
1459                                 if (config_len)
1460                                         memcpy(buf + buf_len - config_len, config_file_buf, config_len);
1461                         }
1462                 }
1463         } else {
1464                 RTKBT_DBG("%s: Not 8723a -> use new style patch", __func__);
1465                 ret_val = get_eversion(fw_info);
1466                 if (ret_val < 0) {
1467                         RTKBT_ERR("%s: Failed to get eversion, errno %d", __func__, ret_val);
1468                         goto fw_fail;
1469                 }
1470                 RTKBT_DBG("%s: Get eversion =%d", __func__, patch_entry->eversion);
1471                 if (memcmp(epatch_buf + buf_len - config_len - 4 , EXTENSION_SECTION_SIGNATURE, 4)) {
1472                         RTKBT_ERR("%s: Failed to check extension section signature", __func__);
1473                         need_download_fw = 0;
1474                 } else {
1475                         uint8_t *temp;
1476                         temp = epatch_buf+buf_len-config_len - 5;
1477                         do {
1478                                 if (*temp == 0x00) {
1479                                         patch_lmp.opcode = *temp;
1480                                         patch_lmp.length = *(temp-1);
1481                                         if ((patch_lmp.data = kzalloc(patch_lmp.length, GFP_KERNEL))) {
1482                                                 int k;
1483                                                 for (k = 0; k < patch_lmp.length; k++) {
1484                                                         *(patch_lmp.data+k) = *(temp-2-k);
1485                                                         RTKBT_DBG("data = 0x%x", *(patch_lmp.data+k));
1486                                                 }
1487                                         }
1488                                         RTKBT_DBG("%s: opcode = 0x%x, length = 0x%x, data = 0x%x", __func__,
1489                                                         patch_lmp.opcode, patch_lmp.length, *(patch_lmp.data));
1490                                         break;
1491                                 }
1492                                 temp -= *(temp-1) + 2;
1493                         } while (*temp != 0xFF);
1494
1495                         if (lmp_version != project_id[*(patch_lmp.data)]) {
1496                                 RTKBT_ERR("%s: Default lmp_version 0x%04x, project_id 0x%04x "
1497                                                 "-> not match", __func__, lmp_version, project_id[*(patch_lmp.data)]);
1498                                 if (patch_lmp.data)
1499                                         kfree(patch_lmp.data);
1500                                 need_download_fw = 0;
1501                         } else {
1502                                 RTKBT_INFO("%s: Default lmp_version 0x%04x, project_id 0x%04x "
1503                                                 "-> match", __func__, lmp_version, project_id[*(patch_lmp.data)]);
1504                                 if (patch_lmp.data)
1505                                         kfree(patch_lmp.data);
1506                                 if (memcmp(epatch_buf, RTK_EPATCH_SIGNATURE, 8)) {
1507                                         RTKBT_ERR("%s: Check signature error", __func__);
1508                                         need_download_fw = 0;
1509                                 } else {
1510                                         epatch_info = (struct rtk_epatch*)epatch_buf;
1511                                         patch_entry->lmp_sub = (uint16_t)epatch_info->fw_version;
1512
1513                                         RTKBT_DBG("%s: lmp version 0x%04x, fw_version 0x%x, "
1514                                                         "number_of_total_patch %d", __func__,
1515                                                         patch_entry->lmp_sub, epatch_info->fw_version,
1516                                                         epatch_info->number_of_total_patch);
1517
1518                                         /* Get right epatch entry */
1519                                         p_epatch_entry = get_fw_patch_entry(epatch_info, patch_entry->eversion);
1520                                         if (p_epatch_entry == NULL) {
1521                                                 RTKBT_WARN("%s: Failed to get fw patch entry", __func__);
1522                                                 ret_val = -1;
1523                                                 goto fw_fail ;
1524                                         }
1525
1526                                         buf_len = p_epatch_entry->patch_length + config_len;
1527                                         RTKBT_DBG("buf_len = 0x%x", buf_len);
1528
1529                                         if (!(buf = kzalloc(buf_len, GFP_KERNEL))) {
1530                                                 RTKBT_ERR("%s: Can't alloc memory for  fw&config", __func__);
1531                                                 buf_len = -1;
1532                                         } else {
1533                                                 memcpy(buf, &epatch_buf[p_epatch_entry->start_offset], p_epatch_entry->patch_length);
1534                                                 memcpy(&buf[p_epatch_entry->patch_length-4], &epatch_info->fw_version, 4);
1535                                                 kfree(p_epatch_entry);
1536                                         }
1537                                         kfree(epatch_buf);
1538                                         epatch_buf = NULL;
1539
1540                                         if (config_len)
1541                                                 memcpy(&buf[buf_len - config_len], config_file_buf, config_len);
1542                                 }
1543                         }
1544                 }
1545         }
1546
1547         if (config_file_buf)
1548                 kfree(config_file_buf);
1549
1550         RTKBT_INFO("%s: fw%s exists, config file%s exists", __func__,
1551                         (buf_len > 0) ? "" : " not", (config_len > 0) ? "":" not");
1552
1553         if (buf && buf_len > 0 && need_download_fw)
1554                 *buff = buf;
1555
1556         RTKBT_DBG("%s: done", __func__);
1557
1558         return buf_len;
1559
1560 fw_fail:
1561         if (config_file_buf)
1562                 kfree(config_file_buf);
1563         return ret_val;
1564 }
1565
1566 int get_firmware(firmware_info *fw_info, int cached)
1567 {
1568         patch_info *patch_entry = fw_info->patch_entry;
1569
1570         RTKBT_INFO("%s: start, cached %d,patch_entry->fw_len= %d", __func__, cached,patch_entry->fw_len);
1571
1572         if (cached > 0) {
1573                 if (patch_entry->fw_len > 0) {
1574                         fw_info->fw_data = kzalloc(patch_entry->fw_len, GFP_KERNEL);
1575                         if (!fw_info->fw_data)
1576                                 return -ENOMEM;
1577                         memcpy(fw_info->fw_data, patch_entry->fw_cache, patch_entry->fw_len);
1578                         fw_info->fw_len = patch_entry->fw_len;
1579                 } else {
1580                         fw_info->fw_len = load_firmware(fw_info, &fw_info->fw_data);
1581                         if (fw_info->fw_len <= 0)
1582                                 return -1;
1583                 }
1584         } else {
1585                 fw_info->fw_len = load_firmware(fw_info, &fw_info->fw_data);
1586                 if (fw_info->fw_len <= 0)
1587                         return -1;
1588         }
1589
1590         return 0;
1591 }
1592
1593 /*
1594  * Open the log message only if in debugging,
1595  * or it will decelerate download procedure.
1596  */
1597 int download_data(firmware_info *fw_info)
1598 {
1599         download_cp *cmd_para;
1600         download_rp *evt_para;
1601         uint8_t *pcur;
1602         int pkt_len, frag_num, frag_len;
1603         int i, ret_val;
1604         int ncmd = 1, step = 1;
1605
1606         RTKBT_DBG("%s: start", __func__);
1607
1608         cmd_para = (download_cp *)fw_info->req_para;
1609         evt_para = (download_rp *)fw_info->rsp_para;
1610         pcur = fw_info->fw_data;
1611         pkt_len = CMD_HDR_LEN + sizeof(download_cp);
1612         frag_num = fw_info->fw_len / PATCH_SEG_MAX + 1;
1613         frag_len = PATCH_SEG_MAX;
1614
1615         for (i = 0; i < frag_num; i++) {
1616                 cmd_para->index = i;
1617                 if (i == (frag_num - 1)) {
1618                         cmd_para->index |= DATA_END;
1619                         frag_len = fw_info->fw_len % PATCH_SEG_MAX;
1620                         pkt_len -= (PATCH_SEG_MAX - frag_len);
1621                 }
1622                 fw_info->cmd_hdr->opcode = cpu_to_le16(DOWNLOAD_OPCODE);
1623                 fw_info->cmd_hdr->plen = sizeof(uint8_t) + frag_len;
1624                 fw_info->pkt_len = pkt_len;
1625                 memcpy(cmd_para->data, pcur, frag_len);
1626
1627                 if (step > 0) {
1628                         ret_val = send_hci_cmd(fw_info);
1629                         if (ret_val < 0) {
1630                                 RTKBT_DBG("%s: Failed to send frag num %d", __func__, cmd_para->index);
1631                                 return ret_val;
1632                         } else
1633                                 RTKBT_DBG("%s: Send frag num %d", __func__, cmd_para->index);
1634
1635                         if (--step > 0 && i < frag_num - 1) {
1636                                 RTKBT_DBG("%s: Continue to send frag num %d", __func__, cmd_para->index + 1);
1637                                 pcur += PATCH_SEG_MAX;
1638                                 continue;
1639                         }
1640                 }
1641
1642                 while (ncmd > 0) {
1643                         ret_val = rcv_hci_evt(fw_info);
1644                         if (ret_val < 0) {
1645                                 RTKBT_ERR("%s: rcv_hci_evt err %d", __func__, ret_val);
1646                                 return ret_val;
1647                         } else {
1648                                 RTKBT_DBG("%s: Receive acked frag num %d", __func__, evt_para->index);
1649                                 ncmd--;
1650                         }
1651
1652                         if (0 != evt_para->status) {
1653                                 RTKBT_ERR("%s: Receive acked frag num %d, err status %d",
1654                                                 __func__, ret_val, evt_para->status);
1655                                 return -1;
1656                         }
1657
1658                         if ((evt_para->index & DATA_END) || (evt_para->index == frag_num - 1)) {
1659                                 RTKBT_DBG("%s: Receive last acked index %d", __func__, evt_para->index);
1660                                 goto end;
1661                         }
1662                 }
1663
1664                 ncmd = step = fw_info->cmd_cmp->ncmd;
1665                 pcur += PATCH_SEG_MAX;
1666                 RTKBT_DBG("%s: HCI command packet num %d", __func__, ncmd);
1667         }
1668
1669         /*
1670          * It is tricky that Host cannot receive DATA_END index from BT
1671          * controller, at least for 8723au. We are doomed if failed.
1672          */
1673 #if 0
1674         /* Continue to receive the responsed events until last index occurs */
1675         if (i == frag_num) {
1676                 RTKBT_DBG("%s: total frag count %d", __func__, frag_num);
1677                 while (!(evt_para->index & DATA_END)) {
1678                         ret_val = rcv_hci_evt(fw_info);
1679                         if (ret_val < 0) {
1680                                 RTKBT_ERR("%s: rcv_hci_evt err %d", __func__, ret_val);
1681                                 return ret_val;
1682                         }
1683                         if (0 != evt_para->status)
1684                                 return -1;
1685                         RTKBT_DBG("%s: continue to receive acked frag num %d", __func__, evt_para->index);
1686                 }
1687         }
1688 #endif
1689 end:
1690         RTKBT_INFO("%s: done, sent %d frag pkts, received %d frag events",
1691                         __func__, cmd_para->index, evt_para->index);
1692         return fw_info->fw_len;
1693 }
1694
1695 int download_patch(firmware_info *fw_info, int cached)
1696 {
1697         int ret_val = 0;
1698
1699         RTKBT_DBG("%s: Download fw patch start, cached %d", __func__, cached);
1700
1701         if (!fw_info || !fw_info->patch_entry) {
1702                 RTKBT_ERR("%s: No patch entry exists(fw_info %p)", __func__, fw_info);
1703                 ret_val = -1;
1704                 goto end;
1705         }
1706
1707         /*
1708          * step1: get local firmware if existed
1709          * step2: check firmware version
1710          * step3: download firmware if updated
1711          */
1712         ret_val = get_firmware(fw_info, cached);
1713         if (ret_val < 0) {
1714                 RTKBT_ERR("%s: Failed to get firmware", __func__);
1715                 goto end;
1716         }
1717
1718         ret_val = check_fw_version(fw_info);
1719         if (ret_val > 0) {
1720                 ret_val = download_data(fw_info);
1721                 if (ret_val > 0)
1722                         RTKBT_DBG("%s: Download fw patch done, fw len %d", __func__, ret_val);
1723         }
1724         /* Free fw data after download finished */
1725         kfree(fw_info->fw_data);
1726         fw_info->fw_data = NULL;
1727
1728 end:
1729         return ret_val;
1730 }
1731
1732 firmware_info *firmware_info_init(struct usb_interface *intf)
1733 {
1734         struct usb_device *udev = interface_to_usbdev(intf);
1735         firmware_info *fw_info;
1736
1737         RTKBT_DBG("%s: start", __func__);
1738
1739         fw_info = kzalloc(sizeof(*fw_info), GFP_KERNEL);
1740         if (!fw_info)
1741                 return NULL;
1742
1743         fw_info->send_pkt = kzalloc(PKT_LEN, GFP_KERNEL);
1744         if (!fw_info->send_pkt) {
1745                 kfree(fw_info);
1746                 return NULL;
1747         }
1748
1749         fw_info->rcv_pkt = kzalloc(PKT_LEN, GFP_KERNEL);
1750         if (!fw_info->rcv_pkt) {
1751                 kfree(fw_info->send_pkt);
1752                 kfree(fw_info);
1753                 return NULL;
1754         }
1755
1756         fw_info->patch_entry = get_fw_table_entry(udev);
1757         if (!fw_info->patch_entry) {
1758                 kfree(fw_info->rcv_pkt);
1759                 kfree(fw_info->send_pkt);
1760                 kfree(fw_info);
1761                 return NULL;
1762         }
1763
1764         fw_info->intf = intf;
1765         fw_info->udev = udev;
1766         fw_info->pipe_in = usb_rcvintpipe(fw_info->udev, INTR_EP);
1767         fw_info->pipe_out = usb_sndctrlpipe(fw_info->udev, CTRL_EP);
1768         fw_info->cmd_hdr = (struct hci_command_hdr *)(fw_info->send_pkt);
1769         fw_info->evt_hdr = (struct hci_event_hdr *)(fw_info->rcv_pkt);
1770         fw_info->cmd_cmp = (struct hci_ev_cmd_complete *)(fw_info->rcv_pkt + EVT_HDR_LEN);
1771         fw_info->req_para = fw_info->send_pkt + CMD_HDR_LEN;
1772         fw_info->rsp_para = fw_info->rcv_pkt + EVT_HDR_LEN + CMD_CMP_LEN;
1773
1774 #if BTUSB_RPM
1775         RTKBT_INFO("%s: Auto suspend is enabled", __func__);
1776         usb_enable_autosuspend(udev);
1777         pm_runtime_set_autosuspend_delay(&(udev->dev), 2000);
1778 #else
1779         RTKBT_INFO("%s: Auto suspend is disabled", __func__);
1780         usb_disable_autosuspend(udev);
1781 #endif
1782
1783 #if BTUSB_WAKEUP_HOST
1784         device_wakeup_enable(&udev->dev);
1785 #endif
1786
1787         return fw_info;
1788 }
1789
1790 void firmware_info_destroy(struct usb_interface *intf)
1791 {
1792         firmware_info *fw_info;
1793         struct usb_device *udev;
1794         struct btusb_data *data;
1795
1796         udev = interface_to_usbdev(intf);
1797         data = usb_get_intfdata(intf);
1798
1799         fw_info = data->fw_info;
1800         if (!fw_info)
1801                 return;
1802
1803 #if BTUSB_RPM
1804         usb_disable_autosuspend(udev);
1805 #endif
1806
1807         /*
1808          * In order to reclaim fw data mem, we free fw_data immediately
1809          * after download patch finished instead of here.
1810          */
1811         kfree(fw_info->rcv_pkt);
1812         kfree(fw_info->send_pkt);
1813         kfree(fw_info);
1814 }
1815
1816 static struct usb_driver btusb_driver;
1817
1818 static struct usb_device_id btusb_table[] = {
1819         { .match_flags = USB_DEVICE_ID_MATCH_VENDOR |
1820                                          USB_DEVICE_ID_MATCH_INT_INFO,
1821           .idVendor = 0x0bda,
1822           .bInterfaceClass = 0xe0,
1823           .bInterfaceSubClass = 0x01,
1824           .bInterfaceProtocol = 0x01 },
1825
1826         { .match_flags = USB_DEVICE_ID_MATCH_VENDOR |
1827                                          USB_DEVICE_ID_MATCH_INT_INFO,
1828           .idVendor = 0x13d3,
1829           .bInterfaceClass = 0xe0,
1830           .bInterfaceSubClass = 0x01,
1831           .bInterfaceProtocol = 0x01 },
1832
1833         { }
1834 };
1835
1836 MODULE_DEVICE_TABLE(usb, btusb_table);
1837
1838 static int inc_tx(struct btusb_data *data)
1839 {
1840         unsigned long flags;
1841         int rv;
1842
1843         spin_lock_irqsave(&data->txlock, flags);
1844         rv = test_bit(BTUSB_SUSPENDING, &data->flags);
1845         if (!rv)
1846                 data->tx_in_flight++;
1847         spin_unlock_irqrestore(&data->txlock, flags);
1848
1849         return rv;
1850 }
1851
1852 void check_sco_event(struct urb *urb)
1853 {
1854         u8* opcode = (u8*)(urb->transfer_buffer);
1855         u8 status;
1856         static uint16_t sco_handle = 0;
1857         uint16_t handle;
1858         struct hci_dev *hdev = urb->context;
1859         struct btusb_data *data = GET_DRV_DATA(hdev);
1860
1861         switch (*opcode) {
1862         case HCI_EV_SYNC_CONN_COMPLETE:
1863                 RTKBT_INFO("%s: HCI_EV_SYNC_CONN_COMPLETE(0x%02x)", __func__, *opcode);
1864                 status = *(opcode + 2);
1865                 sco_handle = *(opcode + 3) | *(opcode + 4) << 8;
1866                 if (status == 0) {
1867                         hdev->conn_hash.sco_num++;
1868                         schedule_work(&data->work);
1869                 }
1870                 break;
1871         case HCI_EV_DISCONN_COMPLETE:
1872                 RTKBT_INFO("%s: HCI_EV_DISCONN_COMPLETE(0x%02x)", __func__, *opcode);
1873                 status = *(opcode + 2);
1874                 handle = *(opcode + 3) | *(opcode + 4) << 8;
1875                 if (status == 0 && sco_handle == handle) {
1876                         hdev->conn_hash.sco_num--;
1877                         schedule_work(&data->work);
1878                 }
1879                 break;
1880         default:
1881                 RTKBT_DBG("%s: event 0x%02x", __func__, *opcode);
1882                 break;
1883         }
1884 }
1885
1886 static void btusb_intr_complete(struct urb *urb)
1887 {
1888         struct hci_dev *hdev = urb->context;
1889         struct btusb_data *data = GET_DRV_DATA(hdev);
1890         int err;
1891
1892         RTKBT_DBG("%s: urb %p status %d count %d ", __func__,
1893                         urb, urb->status, urb->actual_length);
1894
1895         check_sco_event(urb);
1896
1897         if (!test_bit(HCI_RUNNING, &hdev->flags))
1898                 return;
1899
1900
1901         if (urb->status == 0) {
1902                 hdev->stat.byte_rx += urb->actual_length;
1903
1904                 if (hci_recv_fragment(hdev, HCI_EVENT_PKT,
1905                                                 urb->transfer_buffer,
1906                                                 urb->actual_length) < 0) {
1907                         RTKBT_ERR("%s: Corrupted event packet", __func__);
1908                         hdev->stat.err_rx++;
1909                 }
1910         }
1911         /* Avoid suspend failed when usb_kill_urb */
1912         else if(urb->status == -ENOENT) {
1913                 return;
1914         }
1915
1916
1917         if (!test_bit(BTUSB_INTR_RUNNING, &data->flags))
1918                 return;
1919
1920         usb_mark_last_busy(data->udev);
1921         usb_anchor_urb(urb, &data->intr_anchor);
1922
1923         err = usb_submit_urb(urb, GFP_ATOMIC);
1924         if (err < 0) {
1925                 /* EPERM: urb is being killed;
1926                  * ENODEV: device got disconnected */
1927                 if (err != -EPERM && err != -ENODEV)
1928                         RTKBT_ERR("%s: Failed to re-submit urb %p, err %d",
1929                                         __func__, urb, err);
1930                 usb_unanchor_urb(urb);
1931         }
1932 }
1933
1934 static int btusb_submit_intr_urb(struct hci_dev *hdev, gfp_t mem_flags)
1935 {
1936         struct btusb_data *data = GET_DRV_DATA(hdev);
1937         struct urb *urb;
1938         unsigned char *buf;
1939         unsigned int pipe;
1940         int err, size;
1941
1942         if (!data->intr_ep)
1943                 return -ENODEV;
1944
1945         urb = usb_alloc_urb(0, mem_flags);
1946         if (!urb)
1947                 return -ENOMEM;
1948
1949         size = le16_to_cpu(data->intr_ep->wMaxPacketSize);
1950
1951         buf = kmalloc(size, mem_flags);
1952         if (!buf) {
1953                 usb_free_urb(urb);
1954                 return -ENOMEM;
1955         }
1956
1957         RTKBT_DBG("%s: mMaxPacketSize %d, bEndpointAddress 0x%02x",
1958                         __func__, size, data->intr_ep->bEndpointAddress);
1959
1960         pipe = usb_rcvintpipe(data->udev, data->intr_ep->bEndpointAddress);
1961
1962         usb_fill_int_urb(urb, data->udev, pipe, buf, size,
1963                                                 btusb_intr_complete, hdev,
1964                                                 data->intr_ep->bInterval);
1965
1966         urb->transfer_flags |= URB_FREE_BUFFER;
1967
1968         usb_anchor_urb(urb, &data->intr_anchor);
1969
1970         err = usb_submit_urb(urb, mem_flags);
1971         if (err < 0) {
1972                 RTKBT_ERR("%s: Failed to submit urb %p, err %d",
1973                                 __func__, urb, err);
1974                 usb_unanchor_urb(urb);
1975         }
1976
1977         usb_free_urb(urb);
1978
1979         return err;
1980 }
1981
1982 static void btusb_bulk_complete(struct urb *urb)
1983 {
1984         struct hci_dev *hdev = urb->context;
1985         struct btusb_data *data = GET_DRV_DATA(hdev);
1986         int err;
1987
1988         RTKBT_DBG("%s: urb %p status %d count %d",
1989                         __func__, urb, urb->status, urb->actual_length);
1990
1991         if (!test_bit(HCI_RUNNING, &hdev->flags))
1992                 return;
1993
1994         if (urb->status == 0) {
1995                 hdev->stat.byte_rx += urb->actual_length;
1996
1997                 if (hci_recv_fragment(hdev, HCI_ACLDATA_PKT,
1998                                                 urb->transfer_buffer,
1999                                                 urb->actual_length) < 0) {
2000                         RTKBT_ERR("%s: Corrupted ACL packet", __func__);
2001                         hdev->stat.err_rx++;
2002                 }
2003         }
2004         /* Avoid suspend failed when usb_kill_urb */
2005         else if(urb->status == -ENOENT) {
2006                 return;
2007         }
2008
2009
2010         if (!test_bit(BTUSB_BULK_RUNNING, &data->flags))
2011                 return;
2012
2013         usb_anchor_urb(urb, &data->bulk_anchor);
2014         usb_mark_last_busy(data->udev);
2015
2016         err = usb_submit_urb(urb, GFP_ATOMIC);
2017         if (err < 0) {
2018                 /* -EPERM: urb is being killed;
2019                  * -ENODEV: device got disconnected */
2020                 if (err != -EPERM && err != -ENODEV)
2021                         RTKBT_ERR("btusb_bulk_complete %s urb %p failed to resubmit (%d)",
2022                                                 hdev->name, urb, -err);
2023                 usb_unanchor_urb(urb);
2024         }
2025 }
2026
2027 static int btusb_submit_bulk_urb(struct hci_dev *hdev, gfp_t mem_flags)
2028 {
2029         struct btusb_data *data = GET_DRV_DATA(hdev);
2030         struct urb *urb;
2031         unsigned char *buf;
2032         unsigned int pipe;
2033         int err, size = HCI_MAX_FRAME_SIZE;
2034
2035         RTKBT_DBG("%s: hdev name %s", __func__, hdev->name);
2036
2037         if (!data->bulk_rx_ep)
2038                 return -ENODEV;
2039
2040         urb = usb_alloc_urb(0, mem_flags);
2041         if (!urb)
2042                 return -ENOMEM;
2043
2044         buf = kmalloc(size, mem_flags);
2045         if (!buf) {
2046                 usb_free_urb(urb);
2047                 return -ENOMEM;
2048         }
2049
2050         pipe = usb_rcvbulkpipe(data->udev, data->bulk_rx_ep->bEndpointAddress);
2051
2052         usb_fill_bulk_urb(urb, data->udev, pipe,
2053                                         buf, size, btusb_bulk_complete, hdev);
2054
2055         urb->transfer_flags |= URB_FREE_BUFFER;
2056
2057         usb_mark_last_busy(data->udev);
2058         usb_anchor_urb(urb, &data->bulk_anchor);
2059
2060         err = usb_submit_urb(urb, mem_flags);
2061         if (err < 0) {
2062                 RTKBT_ERR("%s: Failed to submit urb %p, err %d", __func__, urb, err);
2063                 usb_unanchor_urb(urb);
2064         }
2065
2066         usb_free_urb(urb);
2067
2068         return err;
2069 }
2070
2071 static void btusb_isoc_complete(struct urb *urb)
2072 {
2073         struct hci_dev *hdev = urb->context;
2074         struct btusb_data *data = GET_DRV_DATA(hdev);
2075         int i, err;
2076
2077
2078         RTKBT_DBG("%s: urb %p status %d count %d",
2079                         __func__, urb, urb->status, urb->actual_length);
2080
2081         if (!test_bit(HCI_RUNNING, &hdev->flags))
2082                 return;
2083
2084         if (urb->status == 0) {
2085                 for (i = 0; i < urb->number_of_packets; i++) {
2086                         unsigned int offset = urb->iso_frame_desc[i].offset;
2087                         unsigned int length = urb->iso_frame_desc[i].actual_length;
2088
2089                         if (urb->iso_frame_desc[i].status)
2090                                 continue;
2091
2092                         hdev->stat.byte_rx += length;
2093
2094                         if (hci_recv_fragment(hdev, HCI_SCODATA_PKT,
2095                                                 urb->transfer_buffer + offset,
2096                                                                 length) < 0) {
2097                                 RTKBT_ERR("%s: Corrupted SCO packet", __func__);
2098                                 hdev->stat.err_rx++;
2099                         }
2100                 }
2101         }
2102         /* Avoid suspend failed when usb_kill_urb */
2103         else if(urb->status == -ENOENT) {
2104                 return;
2105         }
2106
2107
2108         if (!test_bit(BTUSB_ISOC_RUNNING, &data->flags))
2109                 return;
2110
2111         usb_anchor_urb(urb, &data->isoc_anchor);
2112         i = 0;
2113 retry:
2114         err = usb_submit_urb(urb, GFP_ATOMIC);
2115         if (err < 0) {
2116                 /* -EPERM: urb is being killed;
2117                  * -ENODEV: device got disconnected */
2118                 if (err != -EPERM && err != -ENODEV)
2119                         RTKBT_ERR("%s: Failed to re-sumbit urb %p, retry %d, err %d",
2120                                         __func__, urb, i, err);
2121                 if (i < 10) {
2122                         i++;
2123                         mdelay(1);
2124                         goto retry;
2125                 }
2126
2127                 usb_unanchor_urb(urb);
2128         }
2129 }
2130
2131 static inline void fill_isoc_descriptor(struct urb *urb, int len, int mtu)
2132 {
2133         int i, offset = 0;
2134
2135         RTKBT_DBG("%s: len %d mtu %d", __func__, len, mtu);
2136
2137         for (i = 0; i < BTUSB_MAX_ISOC_FRAMES && len >= mtu;
2138                                         i++, offset += mtu, len -= mtu) {
2139                 urb->iso_frame_desc[i].offset = offset;
2140                 urb->iso_frame_desc[i].length = mtu;
2141         }
2142
2143         if (len && i < BTUSB_MAX_ISOC_FRAMES) {
2144                 urb->iso_frame_desc[i].offset = offset;
2145                 urb->iso_frame_desc[i].length = len;
2146                 i++;
2147         }
2148
2149         urb->number_of_packets = i;
2150 }
2151
2152 static int btusb_submit_isoc_urb(struct hci_dev *hdev, gfp_t mem_flags)
2153 {
2154         struct btusb_data *data = GET_DRV_DATA(hdev);
2155         struct urb *urb;
2156         unsigned char *buf;
2157         unsigned int pipe;
2158         int err, size;
2159
2160         if (!data->isoc_rx_ep)
2161                 return -ENODEV;
2162
2163         urb = usb_alloc_urb(BTUSB_MAX_ISOC_FRAMES, mem_flags);
2164         if (!urb)
2165                 return -ENOMEM;
2166
2167         size = le16_to_cpu(data->isoc_rx_ep->wMaxPacketSize) *
2168                                                 BTUSB_MAX_ISOC_FRAMES;
2169
2170         buf = kmalloc(size, mem_flags);
2171         if (!buf) {
2172                 usb_free_urb(urb);
2173                 return -ENOMEM;
2174         }
2175
2176         pipe = usb_rcvisocpipe(data->udev, data->isoc_rx_ep->bEndpointAddress);
2177
2178         urb->dev      = data->udev;
2179         urb->pipe     = pipe;
2180         urb->context  = hdev;
2181         urb->complete = btusb_isoc_complete;
2182         urb->interval = data->isoc_rx_ep->bInterval;
2183
2184         urb->transfer_flags  = URB_FREE_BUFFER | URB_ISO_ASAP;
2185         urb->transfer_buffer = buf;
2186         urb->transfer_buffer_length = size;
2187
2188         fill_isoc_descriptor(urb, size,
2189                         le16_to_cpu(data->isoc_rx_ep->wMaxPacketSize));
2190
2191         usb_anchor_urb(urb, &data->isoc_anchor);
2192
2193         err = usb_submit_urb(urb, mem_flags);
2194         if (err < 0) {
2195                 RTKBT_ERR("%s: Failed to submit urb %p, err %d", __func__, urb, err);
2196                 usb_unanchor_urb(urb);
2197         }
2198
2199         usb_free_urb(urb);
2200
2201         return err;
2202 }
2203
2204 static void btusb_tx_complete(struct urb *urb)
2205 {
2206         struct sk_buff *skb = urb->context;
2207         struct hci_dev *hdev = (struct hci_dev *) skb->dev;
2208         struct btusb_data *data = GET_DRV_DATA(hdev);
2209
2210         if (!test_bit(HCI_RUNNING, &hdev->flags))
2211                 goto done;
2212
2213         if (!urb->status)
2214                 hdev->stat.byte_tx += urb->transfer_buffer_length;
2215         else
2216                 hdev->stat.err_tx++;
2217
2218 done:
2219         spin_lock(&data->txlock);
2220         data->tx_in_flight--;
2221         spin_unlock(&data->txlock);
2222
2223         kfree(urb->setup_packet);
2224
2225         kfree_skb(skb);
2226 }
2227
2228 static void btusb_isoc_tx_complete(struct urb *urb)
2229 {
2230         struct sk_buff *skb = urb->context;
2231         struct hci_dev *hdev = (struct hci_dev *) skb->dev;
2232
2233         RTKBT_DBG("%s: urb %p status %d count %d",
2234                         __func__, urb, urb->status, urb->actual_length);
2235
2236         if (skb && hdev) {
2237                 if (!test_bit(HCI_RUNNING, &hdev->flags))
2238                         goto done;
2239
2240                 if (!urb->status)
2241                         hdev->stat.byte_tx += urb->transfer_buffer_length;
2242                 else
2243                         hdev->stat.err_tx++;
2244         } else
2245                 RTKBT_ERR("%s: skb 0x%p hdev 0x%p", __func__, skb, hdev);
2246
2247 done:
2248         kfree(urb->setup_packet);
2249
2250         kfree_skb(skb);
2251 }
2252
2253 static int btusb_open(struct hci_dev *hdev)
2254 {
2255         struct btusb_data *data = GET_DRV_DATA(hdev);
2256         int err = 0;
2257
2258         RTKBT_INFO("%s: Start, PM usage count %d", __func__,
2259                         atomic_read(&(data->intf->pm_usage_cnt)));
2260
2261         err = usb_autopm_get_interface(data->intf);
2262         if (err < 0)
2263                 return err;
2264
2265         data->intf->needs_remote_wakeup = 1;
2266
2267         err = download_patch(data->fw_info, 1);
2268         if (err < 0) goto failed;
2269
2270         if (test_and_set_bit(HCI_RUNNING, &hdev->flags))
2271                 goto done;
2272
2273         if (test_and_set_bit(BTUSB_INTR_RUNNING, &data->flags))
2274                 goto done;
2275
2276         err = btusb_submit_intr_urb(hdev, GFP_KERNEL);
2277         if (err < 0)
2278                 goto failed;
2279
2280         err = btusb_submit_bulk_urb(hdev, GFP_KERNEL);
2281         if (err < 0) {
2282                 mdelay(URB_CANCELING_DELAY_MS);
2283                 usb_kill_anchored_urbs(&data->intr_anchor);
2284                 goto failed;
2285         }
2286
2287         set_bit(BTUSB_BULK_RUNNING, &data->flags);
2288         btusb_submit_bulk_urb(hdev, GFP_KERNEL);
2289
2290 done:
2291         usb_autopm_put_interface(data->intf);
2292         RTKBT_INFO("%s: End, PM usage count %d", __func__,
2293                         atomic_read(&(data->intf->pm_usage_cnt)));
2294         return 0;
2295
2296 failed:
2297         clear_bit(BTUSB_INTR_RUNNING, &data->flags);
2298         clear_bit(HCI_RUNNING, &hdev->flags);
2299         usb_autopm_put_interface(data->intf);
2300         RTKBT_ERR("%s: Failed, PM usage count %d", __func__,
2301                         atomic_read(&(data->intf->pm_usage_cnt)));
2302         return err;
2303 }
2304
2305 static void btusb_stop_traffic(struct btusb_data *data)
2306 {
2307         mdelay(URB_CANCELING_DELAY_MS);
2308         usb_kill_anchored_urbs(&data->intr_anchor);
2309         usb_kill_anchored_urbs(&data->bulk_anchor);
2310         usb_kill_anchored_urbs(&data->isoc_anchor);
2311 }
2312
2313 static int btusb_close(struct hci_dev *hdev)
2314 {
2315         struct btusb_data *data = GET_DRV_DATA(hdev);
2316         int i, err;
2317
2318         RTKBT_INFO("%s: hci running %lu", __func__, hdev->flags & HCI_RUNNING);
2319
2320         if (!test_and_clear_bit(HCI_RUNNING, &hdev->flags))
2321                 return 0;
2322
2323         for (i = 0; i < NUM_REASSEMBLY; i++) {
2324                 if (hdev->reassembly[i]) {
2325                         RTKBT_DBG("%s: free ressembly[%d]", __func__, i);
2326                         kfree_skb(hdev->reassembly[i]);
2327                         hdev->reassembly[i] = NULL;
2328                 }
2329         }
2330
2331         cancel_work_sync(&data->work);
2332         cancel_work_sync(&data->waker);
2333
2334         clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
2335         clear_bit(BTUSB_BULK_RUNNING, &data->flags);
2336         clear_bit(BTUSB_INTR_RUNNING, &data->flags);
2337
2338         btusb_stop_traffic(data);
2339         err = usb_autopm_get_interface(data->intf);
2340         if (err < 0)
2341                 goto failed;
2342
2343         data->intf->needs_remote_wakeup = 0;
2344         usb_autopm_put_interface(data->intf);
2345
2346 failed:
2347         mdelay(URB_CANCELING_DELAY_MS);
2348         usb_scuttle_anchored_urbs(&data->deferred);
2349         return 0;
2350 }
2351
2352 static int btusb_flush(struct hci_dev *hdev)
2353 {
2354         struct btusb_data *data = GET_DRV_DATA(hdev);
2355
2356         RTKBT_DBG("%s", __func__);
2357
2358         mdelay(URB_CANCELING_DELAY_MS);
2359         usb_kill_anchored_urbs(&data->tx_anchor);
2360
2361         return 0;
2362 }
2363
2364 #if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 13, 0)
2365 static int btusb_send_frame(struct hci_dev *hdev, struct sk_buff *skb)
2366 {
2367 #else
2368 static int btusb_send_frame(struct sk_buff *skb)
2369 {
2370         struct hci_dev *hdev = (struct hci_dev *) skb->dev;
2371 #endif
2372         struct btusb_data *data = GET_DRV_DATA(hdev);
2373         struct usb_ctrlrequest *dr;
2374         struct urb *urb;
2375         unsigned int pipe;
2376         int err;
2377         int retries = 0;
2378
2379         RTKBT_DBG("%s: hdev %p, btusb data %p, pkt type %d",
2380                         __func__, hdev, data, bt_cb(skb)->pkt_type);
2381
2382         if (!test_bit(HCI_RUNNING, &hdev->flags))
2383                 return -EBUSY;
2384
2385 #if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 13, 0)
2386         skb->dev = (void *)hdev;
2387 #endif
2388
2389         switch (bt_cb(skb)->pkt_type) {
2390         case HCI_COMMAND_PKT:
2391                 print_command(skb);
2392                 urb = usb_alloc_urb(0, GFP_ATOMIC);
2393                 if (!urb)
2394                         return -ENOMEM;
2395
2396                 dr = kmalloc(sizeof(*dr), GFP_ATOMIC);
2397                 if (!dr) {
2398                         usb_free_urb(urb);
2399                         return -ENOMEM;
2400                 }
2401
2402                 dr->bRequestType = data->cmdreq_type;
2403                 dr->bRequest     = 0;
2404                 dr->wIndex       = 0;
2405                 dr->wValue       = 0;
2406                 dr->wLength      = __cpu_to_le16(skb->len);
2407
2408                 pipe = usb_sndctrlpipe(data->udev, 0x00);
2409
2410                 usb_fill_control_urb(urb, data->udev, pipe, (void *) dr,
2411                                 skb->data, skb->len, btusb_tx_complete, skb);
2412
2413                 hdev->stat.cmd_tx++;
2414                 break;
2415
2416         case HCI_ACLDATA_PKT:
2417                 print_acl(skb, 1);
2418                 if (!data->bulk_tx_ep)
2419                         return -ENODEV;
2420
2421                 urb = usb_alloc_urb(0, GFP_ATOMIC);
2422                 if (!urb)
2423                         return -ENOMEM;
2424
2425                 pipe = usb_sndbulkpipe(data->udev,
2426                                         data->bulk_tx_ep->bEndpointAddress);
2427
2428                 usb_fill_bulk_urb(urb, data->udev, pipe,
2429                                 skb->data, skb->len, btusb_tx_complete, skb);
2430
2431                 hdev->stat.acl_tx++;
2432                 break;
2433
2434         case HCI_SCODATA_PKT:
2435                 print_sco(skb, 1);
2436                 if (!data->isoc_tx_ep || SCO_NUM < 1) {
2437                         kfree(skb);
2438                         return -ENODEV;
2439                 }
2440
2441                 urb = usb_alloc_urb(BTUSB_MAX_ISOC_FRAMES, GFP_ATOMIC);
2442                 if (!urb) {
2443                         RTKBT_ERR("%s: Failed to allocate mem for sco pkts", __func__);
2444                         kfree(skb);
2445                         return -ENOMEM;
2446                 }
2447
2448                 pipe = usb_sndisocpipe(data->udev, data->isoc_tx_ep->bEndpointAddress);
2449
2450                 usb_fill_int_urb(urb, data->udev, pipe,
2451                                 skb->data, skb->len, btusb_isoc_tx_complete,
2452                                 skb, data->isoc_tx_ep->bInterval);
2453
2454                 urb->transfer_flags  = URB_ISO_ASAP;
2455
2456                 fill_isoc_descriptor(urb, skb->len,
2457                                 le16_to_cpu(data->isoc_tx_ep->wMaxPacketSize));
2458
2459                 hdev->stat.sco_tx++;
2460                 goto skip_waking;
2461
2462         default:
2463                 return -EILSEQ;
2464         }
2465
2466         err = inc_tx(data);
2467         if (err) {
2468                 usb_anchor_urb(urb, &data->deferred);
2469                 schedule_work(&data->waker);
2470                 err = 0;
2471                 goto done;
2472         }
2473
2474 skip_waking:
2475         usb_anchor_urb(urb, &data->tx_anchor);
2476 retry:
2477         err = usb_submit_urb(urb, GFP_ATOMIC);
2478         if (err < 0) {
2479                 RTKBT_ERR("%s: Failed to submit urb %p, pkt type %d, err %d, retries %d",
2480                                 __func__, urb, bt_cb(skb)->pkt_type, err, retries);
2481                 if ((bt_cb(skb)->pkt_type != HCI_SCODATA_PKT) && (retries < 10)) {
2482                         mdelay(1);
2483
2484                         if (bt_cb(skb)->pkt_type == HCI_COMMAND_PKT)
2485                                 print_error_command(skb);
2486                         retries++;
2487                         goto retry;
2488                 }
2489                 kfree(urb->setup_packet);
2490                 usb_unanchor_urb(urb);
2491         } else
2492                 usb_mark_last_busy(data->udev);
2493         usb_free_urb(urb);
2494
2495 done:
2496         return err;
2497 }
2498
2499 #if LINUX_VERSION_CODE <= KERNEL_VERSION(3, 4, 0)
2500 static void btusb_destruct(struct hci_dev *hdev)
2501 {
2502         struct btusb_data *data = GET_DRV_DATA(hdev);
2503
2504         RTKBT_DBG("%s: name %s", __func__, hdev->name);
2505
2506         kfree(data);
2507 }
2508 #endif
2509
2510 static void btusb_notify(struct hci_dev *hdev, unsigned int evt)
2511 {
2512         struct btusb_data *data = GET_DRV_DATA(hdev);
2513
2514         RTKBT_DBG("%s: name %s, evt %d", __func__, hdev->name, evt);
2515
2516         if (SCO_NUM != data->sco_num) {
2517                 data->sco_num = SCO_NUM;
2518                 schedule_work(&data->work);
2519         }
2520 }
2521
2522 static inline int set_isoc_interface(struct hci_dev *hdev, int altsetting)
2523 {
2524         struct btusb_data *data = GET_DRV_DATA(hdev);
2525         struct usb_interface *intf = data->isoc;
2526         struct usb_endpoint_descriptor *ep_desc;
2527         int i, err;
2528
2529         if (!data->isoc)
2530                 return -ENODEV;
2531
2532         err = usb_set_interface(data->udev, 1, altsetting);
2533         if (err < 0) {
2534                 RTKBT_ERR("%s: Failed to set interface, altsetting %d, err %d",
2535                                 __func__, altsetting, err);
2536                 return err;
2537         }
2538
2539         data->isoc_altsetting = altsetting;
2540
2541         data->isoc_tx_ep = NULL;
2542         data->isoc_rx_ep = NULL;
2543
2544         for (i = 0; i < intf->cur_altsetting->desc.bNumEndpoints; i++) {
2545                 ep_desc = &intf->cur_altsetting->endpoint[i].desc;
2546
2547                 if (!data->isoc_tx_ep && usb_endpoint_is_isoc_out(ep_desc)) {
2548                         data->isoc_tx_ep = ep_desc;
2549                         continue;
2550                 }
2551
2552                 if (!data->isoc_rx_ep && usb_endpoint_is_isoc_in(ep_desc)) {
2553                         data->isoc_rx_ep = ep_desc;
2554                         continue;
2555                 }
2556         }
2557
2558         if (!data->isoc_tx_ep || !data->isoc_rx_ep) {
2559                 RTKBT_ERR("%s: Invalid SCO descriptors", __func__);
2560                 return -ENODEV;
2561         }
2562
2563         return 0;
2564 }
2565
2566 static void btusb_work(struct work_struct *work)
2567 {
2568         struct btusb_data *data = container_of(work, struct btusb_data, work);
2569         struct hci_dev *hdev = data->hdev;
2570         int err;
2571         int new_alts;
2572         if (data->sco_num > 0) {
2573                 if (!test_bit(BTUSB_DID_ISO_RESUME, &data->flags)) {
2574                         err = usb_autopm_get_interface(data->isoc ? data->isoc : data->intf);
2575                         if (err < 0) {
2576                                 clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
2577                                 mdelay(URB_CANCELING_DELAY_MS);
2578                                 usb_kill_anchored_urbs(&data->isoc_anchor);
2579                                 return;
2580                         }
2581
2582                         set_bit(BTUSB_DID_ISO_RESUME, &data->flags);
2583                 }
2584 #if LINUX_VERSION_CODE > KERNEL_VERSION(3, 7, 1)
2585                 if (hdev->voice_setting & 0x0020) {
2586                         static const int alts[3] = { 2, 4, 5 };
2587                         new_alts = alts[data->sco_num - 1];
2588                 } else{
2589                         new_alts = data->sco_num;
2590                 }
2591                 if (data->isoc_altsetting != new_alts) {
2592 #else
2593                 if (data->isoc_altsetting != 2) {
2594                         new_alts = 2;
2595 #endif
2596
2597                         clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
2598                         mdelay(URB_CANCELING_DELAY_MS);
2599                         usb_kill_anchored_urbs(&data->isoc_anchor);
2600
2601                         if (set_isoc_interface(hdev, new_alts) < 0)
2602                                 return;
2603                 }
2604
2605                 if (!test_and_set_bit(BTUSB_ISOC_RUNNING, &data->flags)) {
2606                         if (btusb_submit_isoc_urb(hdev, GFP_KERNEL) < 0)
2607                                 clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
2608                         else
2609                                 btusb_submit_isoc_urb(hdev, GFP_KERNEL);
2610                 }
2611         } else {
2612                 clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
2613                 mdelay(URB_CANCELING_DELAY_MS);
2614                 usb_kill_anchored_urbs(&data->isoc_anchor);
2615
2616                 set_isoc_interface(hdev, 0);
2617                 if (test_and_clear_bit(BTUSB_DID_ISO_RESUME, &data->flags))
2618                         usb_autopm_put_interface(data->isoc ? data->isoc : data->intf);
2619         }
2620 }
2621
2622 static void btusb_waker(struct work_struct *work)
2623 {
2624         struct btusb_data *data = container_of(work, struct btusb_data, waker);
2625         int err;
2626
2627         RTKBT_DBG("%s: PM usage count %d", __func__,
2628                         atomic_read(&data->intf->pm_usage_cnt));
2629
2630         err = usb_autopm_get_interface(data->intf);
2631         if (err < 0)
2632                 return;
2633
2634         usb_autopm_put_interface(data->intf);
2635 }
2636
2637
2638 //#ifdef CONFIG_HAS_EARLYSUSPEND
2639 #if 0
2640 static void btusb_early_suspend(struct early_suspend *h)
2641 {
2642         struct btusb_data *data;
2643         firmware_info *fw_info;
2644         patch_info *patch_entry;
2645
2646         RTKBT_INFO("%s", __func__);
2647
2648         data = container_of(h, struct btusb_data, early_suspend);
2649         fw_info = data->fw_info;
2650         patch_entry = fw_info->patch_entry;
2651
2652         patch_entry->fw_len = load_firmware(fw_info, &patch_entry->fw_cache);
2653         if (patch_entry->fw_len <= 0) {
2654                 /* We may encount failure in loading firmware, just give a warning */
2655                 RTKBT_WARN("%s: Failed to load firmware", __func__);
2656         }
2657 }
2658
2659 static void btusb_late_resume(struct early_suspend *h)
2660 {
2661         struct btusb_data *data;
2662         firmware_info *fw_info;
2663         patch_info *patch_entry;
2664
2665         RTKBT_INFO("%s", __func__);
2666
2667         data = container_of(h, struct btusb_data, early_suspend);
2668         fw_info = data->fw_info;
2669         patch_entry = fw_info->patch_entry;
2670
2671         /* Reclaim fw buffer when bt usb resumed */
2672         if (patch_entry->fw_len > 0) {
2673                 kfree(patch_entry->fw_cache);
2674                 patch_entry->fw_cache = NULL;
2675                 patch_entry->fw_len = 0;
2676         }
2677 }
2678 #else
2679 int bt_pm_notify(struct notifier_block *notifier, ulong pm_event, void *unused)
2680 {
2681         struct btusb_data *data;
2682         firmware_info *fw_info;
2683         patch_info *patch_entry;
2684         struct usb_device *udev;
2685
2686         RTKBT_INFO("%s: pm event %ld", __func__, pm_event);
2687
2688         data = container_of(notifier, struct btusb_data, pm_notifier);
2689         fw_info = data->fw_info;
2690         patch_entry = fw_info->patch_entry;
2691         udev = fw_info->udev;
2692
2693         switch (pm_event) {
2694         case PM_SUSPEND_PREPARE:
2695         case PM_HIBERNATION_PREPARE:
2696 #if 0
2697                 patch_entry->fw_len = load_firmware(fw_info, &patch_entry->fw_cache);
2698                 if (patch_entry->fw_len <= 0) {
2699                 /* We may encount failure in loading firmware, just give a warning */
2700                         RTKBT_WARN("%s: Failed to load firmware", __func__);
2701                 }
2702 #endif
2703                 if (!device_may_wakeup(&udev->dev)) {
2704 #if (CONFIG_RESET_RESUME || CONFIG_BLUEDROID)
2705                         RTKBT_INFO("%s:remote wakeup not supported, reset resume supported", __func__);
2706 #else
2707 /*this will force usb driver to disconnect/probe*/
2708                         fw_info->intf->needs_binding = 1;
2709                         RTKBT_INFO("%s:remote wakeup not supported, binding needed", __func__);
2710 #endif
2711                 }
2712                 break;
2713
2714         case PM_POST_SUSPEND:
2715         case PM_POST_HIBERNATION:
2716         case PM_POST_RESTORE:
2717 #if 0
2718                 /* Reclaim fw buffer when bt usb resumed */
2719                 if (patch_entry->fw_len > 0) {
2720                         kfree(patch_entry->fw_cache);
2721                         patch_entry->fw_cache = NULL;
2722                         patch_entry->fw_len = 0;
2723                 }
2724 #endif
2725
2726 #if BTUSB_RPM
2727                 usb_disable_autosuspend(udev);
2728                 usb_enable_autosuspend(udev);
2729                 pm_runtime_set_autosuspend_delay(&(udev->dev), 2000);
2730 #endif
2731                 break;
2732
2733         default:
2734                 break;
2735         }
2736
2737         return NOTIFY_DONE;
2738 }
2739 #endif
2740
2741 static int btusb_probe(struct usb_interface *intf, const struct usb_device_id *id)
2742 {
2743         struct usb_device *udev = interface_to_usbdev(intf);
2744         struct usb_endpoint_descriptor *ep_desc;
2745         struct btusb_data *data;
2746         struct hci_dev *hdev;
2747         firmware_info *fw_info;
2748         int i, err=0;
2749
2750         RTKBT_INFO("%s: usb_interface %p, bInterfaceNumber %d, idVendor 0x%04x, "
2751                         "idProduct 0x%04x", __func__, intf,
2752                         intf->cur_altsetting->desc.bInterfaceNumber,
2753                         id->idVendor, id->idProduct);
2754
2755         /* interface numbers are hardcoded in the spec */
2756         if (intf->cur_altsetting->desc.bInterfaceNumber != 0)
2757                 return -ENODEV;
2758
2759         RTKBT_DBG("%s: can wakeup = %x, may wakeup = %x", __func__,
2760                         device_can_wakeup(&udev->dev), device_may_wakeup(&udev->dev));
2761
2762         data = rtk_alloc(intf);
2763         if (!data)
2764                 return -ENOMEM;
2765
2766         for (i = 0; i < intf->cur_altsetting->desc.bNumEndpoints; i++) {
2767                 ep_desc = &intf->cur_altsetting->endpoint[i].desc;
2768
2769                 if (!data->intr_ep && usb_endpoint_is_int_in(ep_desc)) {
2770                         data->intr_ep = ep_desc;
2771                         continue;
2772                 }
2773
2774                 if (!data->bulk_tx_ep && usb_endpoint_is_bulk_out(ep_desc)) {
2775                         data->bulk_tx_ep = ep_desc;
2776                         continue;
2777                 }
2778
2779                 if (!data->bulk_rx_ep && usb_endpoint_is_bulk_in(ep_desc)) {
2780                         data->bulk_rx_ep = ep_desc;
2781                         continue;
2782                 }
2783         }
2784
2785         if (!data->intr_ep || !data->bulk_tx_ep || !data->bulk_rx_ep) {
2786                 rtk_free(data);
2787                 return -ENODEV;
2788         }
2789
2790         data->cmdreq_type = USB_TYPE_CLASS;
2791
2792         data->udev = udev;
2793         data->intf = intf;
2794
2795         spin_lock_init(&data->lock);
2796
2797         INIT_WORK(&data->work, btusb_work);
2798         INIT_WORK(&data->waker, btusb_waker);
2799         spin_lock_init(&data->txlock);
2800
2801         init_usb_anchor(&data->tx_anchor);
2802         init_usb_anchor(&data->intr_anchor);
2803         init_usb_anchor(&data->bulk_anchor);
2804         init_usb_anchor(&data->isoc_anchor);
2805         init_usb_anchor(&data->deferred);
2806
2807         fw_info = firmware_info_init(intf);
2808         if (fw_info)
2809                 data->fw_info = fw_info;
2810         else {
2811                 RTKBT_WARN("%s: Failed to initialize fw info", __func__);
2812                 /* Skip download patch */
2813                 goto end;
2814         }
2815
2816         RTKBT_INFO("%s: download begining...", __func__);
2817
2818 #if CONFIG_BLUEDROID
2819         mutex_lock(&btchr_mutex);
2820 #endif
2821
2822 #if 0
2823         err = download_patch(fw_info, 0);
2824         /* If download failed, we just throw out a warning */
2825         if (err < 0)
2826                 RTKBT_WARN("%s: Failed to download fw patch", __func__);
2827 #endif
2828
2829 #if CONFIG_BLUEDROID
2830         mutex_unlock(&btchr_mutex);
2831 #endif
2832
2833         RTKBT_INFO("%s: download ending...", __func__);
2834
2835         hdev = hci_alloc_dev();
2836         if (!hdev) {
2837                 rtk_free(data);
2838                 data = NULL;
2839                 return -ENOMEM;
2840         }
2841
2842         HDEV_BUS = HCI_USB;
2843
2844         data->hdev = hdev;
2845
2846         SET_HCIDEV_DEV(hdev, &intf->dev);
2847
2848         hdev->open     = btusb_open;
2849         hdev->close    = btusb_close;
2850         hdev->flush    = btusb_flush;
2851         hdev->send     = btusb_send_frame;
2852         hdev->notify   = btusb_notify;
2853
2854 #if LINUX_VERSION_CODE > KERNEL_VERSION(3, 4, 0)
2855         hci_set_drvdata(hdev, data);
2856 #else
2857         hdev->driver_data = data;
2858         hdev->destruct = btusb_destruct;
2859         hdev->owner = THIS_MODULE;
2860 #endif
2861
2862 #if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 7, 1)
2863         if (!reset_on_close){
2864                 /* set_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks); */
2865                 RTKBT_DBG("%s: Set HCI_QUIRK_RESET_ON_CLOSE", __func__);
2866         }
2867 #endif
2868
2869         /* Interface numbers are hardcoded in the specification */
2870         data->isoc = usb_ifnum_to_if(data->udev, 1);
2871         if (data->isoc) {
2872                 err = usb_driver_claim_interface(&btusb_driver,
2873                                                         data->isoc, data);
2874                 if (err < 0) {
2875                         hci_free_dev(hdev);
2876                         hdev = NULL;
2877                         rtk_free(data);
2878                         data = NULL;
2879                         return err;
2880                 }
2881         }
2882
2883         err = hci_register_dev(hdev);
2884         if (err < 0) {
2885                 hci_free_dev(hdev);
2886                 hdev = NULL;
2887                 rtk_free(data);
2888                 data = NULL;
2889                 return err;
2890         }
2891
2892         usb_set_intfdata(intf, data);
2893
2894 //#ifdef CONFIG_HAS_EARLYSUSPEND
2895 #if 0
2896         data->early_suspend.level = EARLY_SUSPEND_LEVEL_BLANK_SCREEN;
2897         data->early_suspend.suspend = btusb_early_suspend;
2898         data->early_suspend.resume = btusb_late_resume;
2899         register_early_suspend(&data->early_suspend);
2900 #else
2901         data->pm_notifier.notifier_call = bt_pm_notify;
2902         register_pm_notifier(&data->pm_notifier);
2903 #endif
2904
2905 #if CONFIG_BLUEDROID
2906         RTKBT_INFO("%s: Check bt reset flag %d", __func__, bt_reset);
2907         /* Report hci hardware error after everthing is ready,
2908          * especially hci register is completed. Or, btchr_poll
2909          * will get null hci dev when hotplug in.
2910          */
2911         if (bt_reset == 1) {
2912                 hci_hardware_error();
2913                 bt_reset = 0;
2914         } else
2915                 bt_reset = 0; /* Clear and reset it anyway */
2916 #endif
2917
2918 end:
2919         return 0;
2920 }
2921
2922 static void btusb_disconnect(struct usb_interface *intf)
2923 {
2924         struct btusb_data *data = usb_get_intfdata(intf);
2925         struct hci_dev *hdev = NULL;
2926
2927         RTKBT_INFO("%s: usb_interface %p, bInterfaceNumber %d",
2928                         __func__, intf, intf->cur_altsetting->desc.bInterfaceNumber);
2929
2930         if (intf->cur_altsetting->desc.bInterfaceNumber != 0)
2931                 return;
2932
2933         if (data)
2934                 hdev = data->hdev;
2935         else {
2936                 RTKBT_WARN("%s: Failed to get bt usb data[Null]", __func__);
2937                 return;
2938         }
2939
2940 //#ifdef CONFIG_HAS_EARLYSUSPEND
2941 #if 0
2942         unregister_early_suspend(&data->early_suspend);
2943 #else
2944         unregister_pm_notifier(&data->pm_notifier);
2945 #endif
2946
2947         firmware_info_destroy(intf);
2948
2949 #if CONFIG_BLUEDROID
2950         if (test_bit(HCI_RUNNING, &hdev->flags)) {
2951                 RTKBT_INFO("%s: Set BT reset flag", __func__);
2952                 bt_reset = 1;
2953         }
2954 #endif
2955
2956         usb_set_intfdata(data->intf, NULL);
2957
2958         if (data->isoc)
2959                 usb_set_intfdata(data->isoc, NULL);
2960
2961         hci_unregister_dev(hdev);
2962
2963         if (intf == data->isoc)
2964                 usb_driver_release_interface(&btusb_driver, data->intf);
2965         else if (data->isoc)
2966                 usb_driver_release_interface(&btusb_driver, data->isoc);
2967
2968 #if !CONFIG_BLUEDROID
2969 #if LINUX_VERSION_CODE <= KERNEL_VERSION(3, 4, 0)
2970         __hci_dev_put(hdev);
2971 #endif
2972 #endif
2973
2974         hci_free_dev(hdev);
2975         rtk_free(data);
2976         data = NULL;
2977 }
2978
2979 #ifdef CONFIG_PM
2980 static int btusb_suspend(struct usb_interface *intf, pm_message_t message)
2981 {
2982         struct btusb_data *data = usb_get_intfdata(intf);
2983         firmware_info *fw_info = data->fw_info;
2984
2985         RTKBT_INFO("%s: event 0x%x, suspend count %d", __func__,
2986                         message.event, data->suspend_count);
2987
2988         if (intf->cur_altsetting->desc.bInterfaceNumber != 0)
2989                 return 0;
2990
2991         if (!test_bit(HCI_RUNNING, &data->hdev->flags))
2992                 set_bt_onoff(fw_info, 1);
2993
2994         if (data->suspend_count++)
2995                 return 0;
2996
2997         spin_lock_irq(&data->txlock);
2998         if (!((message.event & PM_EVENT_AUTO) && data->tx_in_flight)) {
2999                 set_bit(BTUSB_SUSPENDING, &data->flags);
3000                 spin_unlock_irq(&data->txlock);
3001         } else {
3002                 spin_unlock_irq(&data->txlock);
3003                 data->suspend_count--;
3004                 RTKBT_ERR("%s: Failed to enter suspend", __func__);
3005                 return -EBUSY;
3006         }
3007
3008         cancel_work_sync(&data->work);
3009
3010         btusb_stop_traffic(data);
3011         mdelay(URB_CANCELING_DELAY_MS);
3012         usb_kill_anchored_urbs(&data->tx_anchor);
3013
3014         return 0;
3015 }
3016
3017 static void play_deferred(struct btusb_data *data)
3018 {
3019         struct urb *urb;
3020         int err;
3021
3022         while ((urb = usb_get_from_anchor(&data->deferred))) {
3023                 usb_anchor_urb(urb, &data->tx_anchor);
3024                 err = usb_submit_urb(urb, GFP_ATOMIC);
3025                 if (err < 0) {
3026                         RTKBT_ERR("%s: Failed to submit urb %p, err %d",
3027                                         __func__, urb, err);
3028                         kfree(urb->setup_packet);
3029                         usb_unanchor_urb(urb);
3030                 } else {
3031                         usb_mark_last_busy(data->udev);
3032                 }
3033                 usb_free_urb(urb);
3034
3035                 data->tx_in_flight++;
3036         }
3037         mdelay(URB_CANCELING_DELAY_MS);
3038         usb_scuttle_anchored_urbs(&data->deferred);
3039 }
3040
3041 static int btusb_resume(struct usb_interface *intf)
3042 {
3043         struct btusb_data *data = usb_get_intfdata(intf);
3044         struct hci_dev *hdev = data->hdev;
3045         //firmware_info *fw_info = data->fw_info;
3046         int err = 0;
3047
3048         RTKBT_INFO("%s: Suspend count %d", __func__, data->suspend_count);
3049
3050         if (intf->cur_altsetting->desc.bInterfaceNumber != 0)
3051                 return 0;
3052
3053 #if 0
3054         if (!test_bit(HCI_RUNNING, &hdev->flags)) {
3055                 RTKBT_INFO("%s: Bt is off, download patch before bt is on", __func__);
3056                 download_patch(fw_info, 1);
3057         }
3058 #endif
3059
3060         if (--data->suspend_count)
3061                 return 0;
3062
3063         if (test_bit(BTUSB_INTR_RUNNING, &data->flags)) {
3064                 err = btusb_submit_intr_urb(hdev, GFP_NOIO);
3065                 if (err < 0) {
3066                         clear_bit(BTUSB_INTR_RUNNING, &data->flags);
3067                         goto failed;
3068                 }
3069         }
3070
3071         if (test_bit(BTUSB_BULK_RUNNING, &data->flags)) {
3072                 err = btusb_submit_bulk_urb(hdev, GFP_NOIO);
3073                 if (err < 0) {
3074                         clear_bit(BTUSB_BULK_RUNNING, &data->flags);
3075                         goto failed;
3076                 }
3077
3078                 btusb_submit_bulk_urb(hdev, GFP_NOIO);
3079         }
3080
3081         if (test_bit(BTUSB_ISOC_RUNNING, &data->flags)) {
3082                 if (btusb_submit_isoc_urb(hdev, GFP_NOIO) < 0)
3083                         clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
3084                 else
3085                         btusb_submit_isoc_urb(hdev, GFP_NOIO);
3086         }
3087
3088         spin_lock_irq(&data->txlock);
3089         play_deferred(data);
3090         clear_bit(BTUSB_SUSPENDING, &data->flags);
3091         spin_unlock_irq(&data->txlock);
3092         schedule_work(&data->work);
3093
3094         return 0;
3095
3096 failed:
3097         mdelay(URB_CANCELING_DELAY_MS);
3098         usb_scuttle_anchored_urbs(&data->deferred);
3099         spin_lock_irq(&data->txlock);
3100         clear_bit(BTUSB_SUSPENDING, &data->flags);
3101         spin_unlock_irq(&data->txlock);
3102
3103         return err;
3104 }
3105 #endif
3106
3107 static struct usb_driver btusb_driver = {
3108         .name           = "rtk_btusb",
3109         .probe          = btusb_probe,
3110         .disconnect     = btusb_disconnect,
3111 #ifdef CONFIG_PM
3112         .suspend        = btusb_suspend,
3113         .resume         = btusb_resume,
3114 #endif
3115 #if CONFIG_RESET_RESUME
3116         .reset_resume   = btusb_resume,
3117 #endif
3118         .id_table       = btusb_table,
3119         .supports_autosuspend = 1,
3120 #if LINUX_VERSION_CODE > KERNEL_VERSION(3, 7, 1)
3121         .disable_hub_initiated_lpm = 1,
3122 #endif
3123 };
3124
3125 static int __init btusb_init(void)
3126 {
3127         int err;
3128
3129         RTKBT_INFO("Realtek Bluetooth USB driver module init, version %s", VERSION);
3130 #if CONFIG_BLUEDROID
3131         err = btchr_init();
3132         if (err < 0) {
3133                 /* usb register will go on, even bt char register failed */
3134                 RTKBT_ERR("Failed to register usb char device interfaces");
3135         } else
3136                 bt_char_dev_registered = 1;
3137 #endif
3138         err = usb_register(&btusb_driver);
3139         if (err < 0)
3140                 RTKBT_ERR("Failed to register RTK bluetooth USB driver");
3141         return err;
3142 }
3143
3144 static void __exit btusb_exit(void)
3145 {
3146         RTKBT_INFO("Realtek Bluetooth USB driver module exit");
3147 #if CONFIG_BLUEDROID
3148         if (bt_char_dev_registered > 0)
3149                 btchr_exit();
3150 #endif
3151         usb_deregister(&btusb_driver);
3152 }
3153
3154 module_init(btusb_init);
3155 module_exit(btusb_exit);
3156
3157 MODULE_AUTHOR("Realtek Corporation");
3158 MODULE_DESCRIPTION("Realtek Bluetooth USB driver version");
3159 MODULE_VERSION(VERSION);
3160 MODULE_LICENSE("GPL");